Skip to content

Commit def0883

Browse files
committed
fix: use tab instead of space characters for indentation
1 parent 0c24d1d commit def0883

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

sysmonconfig-export.xml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -478,11 +478,11 @@
478478
<!--DATA: UtcTime, SourceProcessGuid, SourceProcessId, SourceThreadId, SourceImage, TargetProcessGuid, TargetProcessId, TargetImage, GrantedAccess, CallTrace-->
479479
<RuleGroup name="" groupRelation="or">
480480
<ProcessAccess onmatch="include">
481-
<CallTrace condition="begin with">UNKNOWN</CallTrace> <!-- CobaltStrike BOF using NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
482-
<Rule groupRelation="and">
483-
<TargetImage name="lsass.exe access" condition="end with">lsass.exe</TargetImage>
484-
<GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
485-
</Rule>
481+
<CallTrace condition="begin with">UNKNOWN</CallTrace> <!-- CobaltStrike BOF using NtOpenProcess Ref: https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 -->
482+
<Rule groupRelation="and">
483+
<TargetImage name="lsass.exe access" condition="end with">lsass.exe</TargetImage>
484+
<GrantedAccess condition="contains any">0x40,0x1000,0x1010,0x1038,0x1410,0x1418,0x1438,0x143a,0x100000,0x1f0fff,0x1f1fff,0x1f2fff,0x1f3fff,0x1fffff</GrantedAccess> <!--0x1400 too noisy-->
485+
</Rule>
486486
</ProcessAccess>
487487
</RuleGroup>
488488

0 commit comments

Comments
 (0)