Detect net.exe from non-shell parents and exclude net.exe as a net1 parent

[mvanhorn]

Details

The search adds net.exe to Processes.process_name and to the Processes.parent_process_name exclusion list, next to the existing shells and explorer.exe. The description now names net.exe as a target and as an excluded parent. The detection version moves from 13 to 14 and the modification date is set to 2026-10-12.

The analytic does not alert when a non-shell process starts net.exe, so that step in a discovery chain is missed. It does alert on net1.exe whose parent is net.exe, including the ordinary chain from an allowed shell through net.exe to net1.exe, which adds an extra finding and can raise the entity risk score. The search matches process names that include net1.exe and omit net.exe, so only the child is eligible. The parent exclusion covers cmd.exe, PowerShell, pwsh.exe, explorer.exe, and unknown parents, and does not include net.exe, so a net1.exe process whose parent is net.exe still matches.

Fixes #4334

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
  Not claimed: no local test run is recorded for detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml.
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.
  Left unticked: nothing in this change to detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml backs it.
• Confirm updates to lookups are handled properly.

Notes For Submitters and Reviewers

Nothing beyond what is described above.