Merge branch 'master' of https://github.com/Neo23x0/sigma

rules/windows/builtin/win_susp_process_creations.yml

@@ -1,7 +1,7 @@
 ---
 action: global
 title: Suspicious Process Creation
-description: Detects suspicious process starts on Windows systems bsed on keywords
+description: Detects suspicious process starts on Windows systems based on keywords
 status: experimental
 references:
     - https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/
@@ -65,7 +65,7 @@ detection:
             # AddInProcess
             - '*AddInProcess*'
             # NotPowershell (nps) attack
-            - '*msbuild*'
+            # - '*msbuild*'  # too many false positives
     condition: selection
 falsepositives: 
     - False positives depend on scripts and administrative tools used in the monitored environment