Issue: https://github.com/Neo23x0/sigma/issues/888 The rules were not merged correctly with the transition to sysmon categories. Split the rule into separate documents: one for the registry_event and one for the process_creation