sysmon eventid 3: filter on outgoing connections (initiated: true) to avoid false positives

rules/windows/sysmon/sysmon_win_binary_github_com.yml

@@ -14,6 +14,7 @@ logsource:
 detection:
     selection:
         EventID: 3
+        Initiated: 'true'
         DestinationHostname: 
             - '*.github.com'
             - '*.githubusercontent.com'