Cosmetics

If it's only 1 value we write it like this to avoid it being interpreted as a list with 1 element and to avoid an extra line.
2024-11-07 09:48:58 +00:00 · 2018-07-25 07:37:17 +02:00 · 2018-07-25 07:37:17 +02:00 · dd857c4470
commit dd857c4470
parent b415fc8d42
1 changed files with 1 additions and 2 deletions
--- a/rules/windows/sysmon/sysmon_ghostpack_safetykatz.yml
+++ b/rules/windows/sysmon/sysmon_ghostpack_safetykatz.yml
@ -14,8 +14,7 @@ logsource:
 detection:
    selection:
        EventID: 11
-        TargetFilename:
-             '*\Temp\debug.bin'
+        TargetFilename: '*\Temp\debug.bin'
    condition: selection
 falsepositives:
    - Unknown