From 0fbbbd19dcf6b9564ae0603765f80a2dbbde6974 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Tue, 12 Jul 2022 19:44:41 +0200
Subject: [PATCH] fix list

---
 .../builtin/msexchange/win_exchange_transportagent_failed.yml  | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml b/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml
index 59d79fbce..5df724d89 100644
--- a/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml
+++ b/rules/windows/builtin/msexchange/win_exchange_transportagent_failed.yml
@@ -17,8 +17,7 @@ logsource:
 detection:
     selection:
         EventID: 6 
-        Data|contains:
-            - 'Install-TransportAgent'
+        Data|contains: 'Install-TransportAgent'
     condition: selection
 fields:
     - AssemblyPath