convert eventID to category

rules/windows/sysmon/sysmon_config_modification.yml

@@ -1,32 +1,38 @@
+action: global
 title: Sysmon Configuration Modification
 id: 1f2b5353-573f-4880-8e33-7d04dcf97744
 description: Someone try to hide from Sysmon
 status: experimental
 author: frack113
 date: 2021/06/04
+modified: 2021/06/10
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md
     - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
 tags:
     - attack.defense_evasion
     - attack.t1564
+falsepositives:
+    - legitimate administrative action
+level: high    
+---
 logsource:
     product: windows
-    service: sysmon
+    category: sysmon_status
 detection:
     selection_stop:
-        EventID: 4
         State: Stopped
     selection_conf:
-        EventID: 16
         message|startswith:
             - 'Sysmon config state changed'
+    condition: selection_stop or selection_conf
+---
+logsource:
+    product: windows
+    category: sysmon_error
+detection:
     selection_error:
-        EventID: 255
         Description|contains:
             - 'Failed to open service configuration with error'
             - 'Failed to connect to the driver to update configuration'
-    condition: 1 of them
-falsepositives:
-    - legitimate administrative action
-level: high
+    condition: selection_error