Merge pull request #451 from EccoTheFlintstone/sysmon_clean

sysmon rules cleanup and move to process_creation

rules/windows/process_creation/win_control_panel_item.yml

@@ -12,7 +12,7 @@ date: 2019/08/27
 level: critical
 logsource:
   product: windows
-  service: sysmon
+  category: process_creation
 detection:
   selection:
     CommandLine: '*.cpl'

rules/windows/process_creation/win_powersploit_empire_schtasks.yml

@@ -9,11 +9,11 @@ author: Markus Neis, @Karneades
 date: 2018/03/06
 logsource:
     product: windows
-    service: sysmon
+    category: process_creation
 detection:
     selection:
         ParentImage:
-            - '*\Powershell.exe'
+            - '*\powershell.exe'
         CommandLine:
             - '*schtasks*/Create*/SC *ONLOGON*/TN *Updater*/TR *powershell*'
             - '*schtasks*/Create*/SC *DAILY*/TN *Updater*/TR *powershell*'