[Rule Tuning] Disable Windows Firewall Rules via Netsh (#2231)

Co-authored-by: Terrance DeJesus <99630311+terrancedejesus@users.noreply.github.com>
Co-authored-by: Jonhnathan <jonhnathancesar@gmail.com>

(cherry picked from commit 3ba777c)

rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml

@@ -64,8 +64,10 @@ type = "eql"
 query = '''
 process where event.type in ("start", "process_started") and
   process.name : "netsh.exe" and
-  (process.args : "disable" and process.args : "firewall" and process.args : "set") or
-  (process.args : "advfirewall" and process.args : "off" and process.args : "state")
+  (
+    (process.args : "disable" and process.args : "firewall" and process.args : "set") or
+    (process.args : "advfirewall" and process.args : "off" and process.args : "state")
+  )
 '''