fix: replace space with _

rules/windows/other/win_defender_amsi_trigger.yml

@@ -13,11 +13,11 @@ logsource:
 detection:
     selection:
         EventID: 1116
-        Source Name: 'AMSI'
+        Source_Name: 'AMSI'
     condition: selection
 falsepositives:
     - unlikely
 level: high
 tags:
     - attack.execution
-    - attack.t1059 
+    - attack.t1059 

rules/windows/other/win_defender_exclusions.yml

@@ -17,8 +17,8 @@ logsource:
 detection:
     selection1:
         EventID: 5007
-        New Value|contains: '\Microsoft\Windows Defender\Exclusions'
+        New_Value|contains: '\Microsoft\Windows Defender\Exclusions'
     condition: selection1
 falsepositives:
     - Administrator actions
-level: medium
+level: medium