Feature/#140 document (#144)

* update

* fix regexes and whitelist

* underconstructing

* fix

* update

* add pic

* update

* update

* update

* fix

rules/deep_blue_cli/sysmon/1.yml

@@ -1,8 +1,6 @@
 title: Sysmon Check command lines
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Sysmon
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: medium
 output: 'CommandLine=%CommandLine%¥nParentImage=%ParentImage%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8

rules/deep_blue_cli/sysmon/7.yml

@@ -1,8 +1,6 @@
 title: Check for unsigned EXEs/DLLs
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
     selection:
         Channel: Sysmon
@@ -11,7 +9,6 @@ detection:
     # condition: selection
 falsepositives:
     - unknown
-level: low
 output: 'Message: Unsigned Image(DLL)¥n Result : Loaded by: %event_data.Image%¥nCommand : %event_data.ImageLoaded%'
 creation_date: 2020/11/8
 uodated_date: 2020/11/8