search

olafhartong / sysmon-modular

A repository of sysmon configuration modules
MIT License
2.62k stars 585 forks source link

In line 1616 could be a typo #172

Closed Andeandes closed 1 year ago

Andeandes commented 1 year ago

`<TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="contains all">HKLM\software\lmicrosoft\microsoft antimalware\exclusions\`

<TargetObject name="technique_id=T1089,technique_name=Disabling Security Tools" condition="begin with">HKLM\software\microsoft\microsoft antimalware\exclusions\paths\</TargetObject>

I don't know if that is correct. But in my opinion it should be called microsoft...

many greetings Dean

olafhartong commented 1 year ago

you are right, thanks for spotting it! I've addressed it