use ps.uuid field for connecting the events

rabbitstack · rabbitstack · commit ae9939d2ac5f · 2023-03-31T16:46:39.000+02:00
diff --git a/rules/defense_evasion_system_binary_proxy_execution.yml b/rules/defense_evasion_system_binary_proxy_execution.yml
@@ -36,8 +36,8 @@
                 '*-sta*',
                 '*RunHTMLApplication*',
               )
-          | by ps.child.pid
-          |spawn_process| by ps.pid
+          | by ps.child.uuid
+          |spawn_process| by ps.uuid
       action: >
         {{
             emit . "System Binary Proxy Execution via Rundll32" ""
