From fe71d21d97de7d39efd4a0cc6a4c08d367cdaebd Mon Sep 17 00:00:00 2001 From: Florian Roth Date: Wed, 1 Jul 2020 09:11:00 +0200 Subject: [PATCH] style: removed new lines --- rules/windows/registry_event/sysmon_susp_service_installed.yml | 1 - .../registry_event/sysmon_suspicious_keyboard_layout_load.yml | 1 - 2 files changed, 2 deletions(-) diff --git a/rules/windows/registry_event/sysmon_susp_service_installed.yml b/rules/windows/registry_event/sysmon_susp_service_installed.yml index 920c884ae..0b69557ec 100755 --- a/rules/windows/registry_event/sysmon_susp_service_installed.yml +++ b/rules/windows/registry_event/sysmon_susp_service_installed.yml @@ -14,7 +14,6 @@ logsource: product: windows detection: selection_1: - TargetObject: - 'HKLM\System\CurrentControlSet\Services\NalDrv\ImagePath' - 'HKLM\System\CurrentControlSet\Services\PROCEXP152\ImagePath' diff --git a/rules/windows/registry_event/sysmon_suspicious_keyboard_layout_load.yml b/rules/windows/registry_event/sysmon_suspicious_keyboard_layout_load.yml index ee1ac4d78..aa2a1b1db 100755 --- a/rules/windows/registry_event/sysmon_suspicious_keyboard_layout_load.yml +++ b/rules/windows/registry_event/sysmon_suspicious_keyboard_layout_load.yml @@ -14,7 +14,6 @@ logsource: definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files' detection: selection_registry: - TargetObject: - '*\Keyboard Layout\Preload\*' - '*\Keyboard Layout\Substitutes\*'