From 8adaa2d6724185bdf09dd0bbfbaef57b737d9441 Mon Sep 17 00:00:00 2001
From: Remco Hofman <rhofman@nviso.be>
Date: Wed, 10 Jun 2020 15:02:41 +0200
Subject: [PATCH] Fixed bad indentation

---
 rules/windows/sysmon/sysmon_office_persistence.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/sysmon/sysmon_office_persistence.yml b/rules/windows/sysmon/sysmon_office_persistence.yml
index 71db0b36c..813929a0f 100644
--- a/rules/windows/sysmon/sysmon_office_persistence.yml
+++ b/rules/windows/sysmon/sysmon_office_persistence.yml
@@ -26,7 +26,7 @@ detection:
     TargetFilename|endswith:
       - .xlam
       - .xla
-condition: selection and (wlldropped or xlldropped or generic)
+  condition: selection and (wlldropped or xlldropped or generic)
 falsepositives:
   - Legitimate add-ins
 level: high