From f553fb2e33a5fc1681fbd7cb7a0cf3d9b22ce5fe Mon Sep 17 00:00:00 2001
From: Florian Roth <venom14@gmail.com>
Date: Wed, 10 Jun 2020 16:35:14 +0200
Subject: [PATCH] Cosmetics

---
 rules/windows/sysmon/sysmon_reg_office_security.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rules/windows/sysmon/sysmon_reg_office_security.yml b/rules/windows/sysmon/sysmon_reg_office_security.yml
index e9f00dda7..31fa9e192 100644
--- a/rules/windows/sysmon/sysmon_reg_office_security.yml
+++ b/rules/windows/sysmon/sysmon_reg_office_security.yml
@@ -17,14 +17,14 @@ logsource:
 detection:
     sec_settings:
       EventID:
-        - 12
-        - 13
+            - 12
+            - 13
       TargetObject|endswith:
             - '*\Security\Trusted Documents\TrustRecords'
             - '*\Security\AccessVBOM'
             - '*\Security\VBAWarnings'
       EventType:
-        - SetValue
-        - DeleteValue
-        - CreateValue
+            - SetValue
+            - DeleteValue
+            - CreateValue
     condition: sec_settings