Add severity level to RegSvcs suspicious calltrace rule

Added a level field to specify the severity of the detection.

Author: grepstrength

rules/windows/process_creation/proc_creation_win_regsvcs_suspicious_calltrace.yml

@@ -1,14 +1,14 @@
-title: Suspicious Shellcode Injection into RegSvcs.exe
+title: Suspicious Shellcode Injection into RegSvcs
 id: 42833cf3-dd1d-4530-8c87-90c55393ad42
 status: experimental
-description: Detects potential shellcode injection into RegSvcs.exe based on suspicious Windows API calls. 
+description: Detects potential shellcode injection into RegSvcs.exe based on suspicious Windows API calls.
 references:
-  - https://osintteam.blog/opened-a-can-of-xworms-33fde9d2aee6
+    - https://osintteam.blog/opened-a-can-of-xworms-33fde9d2aee6
 author: Kelvin "grepStrength" Winborne
 date: 2025/10/15
 tags:
-  - attack.execution
-  - attack.t1055
+    - attack.execution
+    - attack.t1055
 logsource:
   category: process_creation
   product: windows
@@ -23,10 +23,10 @@ detection:
     - CallTrace|contains: 'NtProtectVirtualMemory'
   condition: selection and 1 of suspicious_behavior
 fields:
-  - Image
-  - ParentImage
-  - CommandLine
-  - CallTrace
+    - Image
+    - ParentImage
+    - CommandLine
+    - CallTrace
 falsepositives:
-  - Known .NET assembly registration
-level: high
+    - Known .NET assembly registration
+level: high