Windows Security Center State Changed Map

[reece394]

Description

I read an interesting post on SANS here and noticed the Event Log mentioned wasn't mapped yet hence the pull request.

Added a map file for Event ID 15 which is triggered when the Security Center state is changed.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

• I have ensured a Provider is listed for the new Map(s) being submitted
• I have ensured the filename(s) of any new Map(s) being submitted follows the approved format, i.e. Channel-Name_Provider-Name_EventID.map. In summary, all spaces and special characters are replaced with a hyphen with an underscore separates Channel Name, Provider Name, and Event ID
• I have tested and validated the new Map(s) work with my test data and achieve the desired output
• I have provided example event data (# Example Event Data:) at the bottom of my Map(s), if possible
• I have consulted the Guide/Template to ensure my Map(s) follow the same format

Thank you for your submission and for contributing to the DFIR community!