From 5aaf0b19e4fc21140244158d76b2c9b172695b7b Mon Sep 17 00:00:00 2001
From: remi <github@xiri.fr>
Date: Wed, 26 May 2021 12:35:34 +0200
Subject: [PATCH] Fix FileDelete example.

---
 sysmonconfig-export.xml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index f4acf26c..f4527e67 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -1101,7 +1101,7 @@
 	</RuleGroup>
 
 	<!--SYSMON EVENT ID 23 : FILE DELETE [FileDelete]-->
-		<!--EVENT 22: "File Delete"-->
+		<!--EVENT 23: "File Delete"-->
 		<!--COMMENT:	Sandbox usage. When a program signals to Windows a file should be deleted or wiped, Sysmon may be able to capture it. 
 			[ https://isc.sans.edu/forums/diary/Sysmon+and+File+Deletion/26084/ ]
 		-->
@@ -1110,8 +1110,8 @@
 
 	<!--
 	<RuleGroup name="" groupRelation="or">
-		<ClipboardChange onmatch="include">
-		</ClipboardChange>
+		<FileDelete onmatch="include">
+		</FileDelete>
 	</RuleGroup>
 	-->
 
@@ -1156,4 +1156,4 @@
 		<!--Cannot be filtered.-->
 
 	</EventFiltering>
-</Sysmon>
\ No newline at end of file
+</Sysmon>