From 235e4416fec62beb37c5ddb086de978797161834 Mon Sep 17 00:00:00 2001
From: pe3zx <pansaen@i-secure.co.th>
Date: Thu, 14 Dec 2017 22:33:50 +0700
Subject: [PATCH] Add 'Sysinternals Sysmon suspicious activity guide' to Sysmon
 tutorial

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 5652717..e24a3d1 100644
--- a/README.md
+++ b/README.md
@@ -408,6 +408,7 @@ My curated list of awesome links, resources and tools
         <td>Sysmon</td>
         <td>
             <ul>
+                <li><a href="https://blogs.technet.microsoft.com/motiba/2017/12/07/sysinternals-sysmon-suspicious-activity-guide/">Sysinternals Sysmon suspicious activity guide</a></li>
                 <li><a href="http://www.hexacorn.com/blog/2017/10/02/sysmon-doing-lines/">Sysmon doing lines</a></li>
                 <li><a href="https://github.com/MHaggis/sysmon-dfir">Mhaggis/sysmon-dfir</a></li>
                 <li><a href="http://syspanda.com/index.php/2017/02/28/deploying-sysmon-through-gpo/">Deploying Sysmon through Group Policy (GPO)</a></li>