Summary

This updates one existing Windows process creation rule:

rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml

The current condition is parsed so the filter_main_msiexec false-positive filter only applies to the WMI branch:

A or B or C and not filter

Because and binds tighter than or, the filter does not apply to the wevtutil or PowerShell branches. This PR groups the three detection branches first, then applies the filter to the full expression:

(A or B or C) and not filter

It also fixes a nearby comment typo: uset to used.

Validation

sigma check rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml

Result:

Found 0 errors, 0 condition errors and 0 issues.
No rule errors found.
No condition errors found.
No validation issues found.

Scope

This PR intentionally touches one existing rule only. No new rules are added.