regex rule implemented

rules/deep_blue_cli/sysmon/1.yml

@@ -0,0 +1,19 @@
+title: Sysmon Check command lines
+description: hogehoge
+enabled: true
+author: Yea
+logsource: 
+    product: windows
+detection:
+    selection:
+        Channel: Sysmon
+        EventID: 1
+        CommandLine: '.+'
+    # condition: selection
+falsepositives:
+    - unknown
+level: medium
+output: 'CommandLine=%CommandLine%¥nParentImage=%ParentImage%'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8
+

rules/deep_blue_cli/sysmon/7.yml

@@ -0,0 +1,18 @@
+title: Check for unsigned EXEs/DLLs
+description: hogehoge
+enabled: true
+author: Yea
+logsource: 
+    product: windows
+detection:
+    selection:
+        Channel: Sysmon
+        EventID: 7
+        Signed: "false" # Compare by string
+    # condition: selection
+falsepositives:
+    - unknown
+level: low
+output: 'Message: Unsigned Image(DLL)¥n Result : Loaded by: %event_data.Image%¥nCommand : %event_data.ImageLoaded%'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8