Unified 0x values with other rules

2024-11-07 09:48:58 +00:00 · 2018-05-13 22:27:12 +02:00 · 2018-05-13 22:27:12 +02:00 · 6a3fcdc68c
commit 6a3fcdc68c
parent 429ae0729a
1 changed files with 5 additions and 5 deletions
--- a/rules/windows/builtin/win_susp_failed_logon_reasons.yml
+++ b/rules/windows/builtin/win_susp_failed_logon_reasons.yml
@ -10,11 +10,11 @@ detection:
            - 4625
            - 4776
        Status:
-            - 0xC0000072
-            - 0xC000006F
-            - 0xC0000070
-            - 0xC0000413
-            - 0xC000018C
+            - '0xC0000072'
+            - '0xC000006F'
+            - '0xC0000070'
+            - '0xC0000413'
+            - '0xC000018C'
    condition: selection
 falsepositives:
    - User using a disabled account