Merge pull request #42 from rathbuna/master

Various fixes
EricZimmerman · Dec 5, 2020 · 92a767b · 92a767b
2 parents de64438 + f3b2778
commit 92a767b
Show file tree

Hide file tree

Showing 15 changed files with 25 additions and 25 deletions.
diff --git a/evtx/Maps/Microsoft-Windows-SysMon_Operational_1.map b/evtx/Maps/Microsoft-Windows-SysMon_Operational_1.map
@@ -61,7 +61,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"ParentCommandLine\"]"
   - 
     Property: UserName
-"%User%"
+    PropertyValue: "%User%"
     Values: 
       - 
         Name: User

diff --git a/evtx/Maps/Microsoft-Windows-SysMon_Operational_19.map b/evtx/Maps/Microsoft-Windows-SysMon_Operational_19.map
@@ -47,7 +47,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"EventNamespace\"]"   
   - 
     Property: UserName
-"%User%"
+    PropertyValue: "%User%"
     Values: 
       - 
         Name: User

diff --git a/evtx/Maps/Microsoft-Windows-SysMon_Operational_20.map b/evtx/Maps/Microsoft-Windows-SysMon_Operational_20.map
@@ -55,7 +55,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"Destination\"]"   
   - 
     Property: UserName
-"%User%"
+    PropertyValue: "%User%"
     Values: 
       - 
         Name: User

diff --git a/evtx/Maps/Microsoft-Windows-SysMon_Operational_21.map b/evtx/Maps/Microsoft-Windows-SysMon_Operational_21.map
@@ -41,7 +41,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"Filter\"]"   
   - 
     Property: UserName
-"%User%"
+    PropertyValue: "%User%"
     Values: 
       - 
         Name: User

diff --git a/evtx/Maps/Microsoft-Windows-SysMon_Operational_3.map b/evtx/Maps/Microsoft-Windows-SysMon_Operational_3.map
@@ -51,7 +51,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"DestinationIp\"]"  
   - 
     Property: UserName
-"%User%"
+    PropertyValue: "%User%"
     Values: 
       - 
         Name: User

diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_100.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_100.map
@@ -5,21 +5,21 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
 Maps: 
   - 
     Property: PayloadData1
-PropertyValue: "Task: %TaskName%"
+    PropertyValue: "Task: %TaskName%"
     Values: 
       - 
         Name: TaskName
         Value: "/Event/EventData/Data[@Name=\"TaskName\"]"
   - 
     Property: PayloadData2
-    PropertyValue: Context: %UserContext%
+    PropertyValue: "Context: %UserContext%"
     Values: 
       - 
         Name: UserContext
         Value: "/Event/EventData/Data[@Name=\"UserContext\"]"
   -
     Property: PayloadData3
-    PropertyValue: Instance Id: %InstanceId%
+    PropertyValue: "Instance Id: %InstanceId%"
     Values: 
       - 
         Name: InstanceId

diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_102.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_102.map
@@ -5,21 +5,21 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
 Maps: 
   - 
     Property: PayloadData1
-PropertyValue: "Task: %TaskName%"
+    PropertyValue: "Task: %TaskName%"
     Values: 
       - 
         Name: TaskName
         Value: "/Event/EventData/Data[@Name=\"TaskName\"]"
   - 
     Property: PayloadData2
-    PropertyValue: Context: %UserContext%
+    PropertyValue: "Context: %UserContext%"
     Values: 
       - 
         Name: UserContext
         Value: "/Event/EventData/Data[@Name=\"UserContext\"]"
   -
     Property: PayloadData3
-    PropertyValue: Instance Id: %InstanceId%
+    PropertyValue: "Instance Id: %InstanceId%"
     Values: 
       - 
         Name: InstanceId

diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_106.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_106.map
@@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
 Maps: 
   - 
     Property: PayloadData1
-PropertyValue: "Task: %TaskName%"
+    PropertyValue: "Task: %TaskName%"
     Values: 
       - 
         Name: TaskName

diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_119.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_119.map
@@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
 Maps: 
   - 
     Property: PayloadData1
-PropertyValue: "Task: %TaskName%"
+    PropertyValue: "Task: %TaskName%"
     Values: 
       - 
         Name: TaskName
@@ -19,7 +19,7 @@ PropertyValue: "Task: %TaskName%"
         Value: "/Event/EventData/Data[@Name=\"UserName\"]"
   -
     Property: PayloadData3
-    PropertyValue: Instance Id: %InstanceId%
+    PropertyValue: "Instance Id: %InstanceId%"
     Values: 
       - 
         Name: InstanceId

diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_141.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_141.map
@@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
 Maps: 
   - 
     Property: PayloadData1
-PropertyValue: "Task: %TaskName%"
+    PropertyValue: "Task: %TaskName%"
     Values: 
       - 
         Name: TaskName

diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_200.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_200.map
@@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
 Maps: 
   - 
     Property: PayloadData1
-PropertyValue: "Task: %TaskName%"
+    PropertyValue: "Task: %TaskName%"
     Values: 
       - 
         Name: TaskName
@@ -19,7 +19,7 @@ PropertyValue: "Task: %TaskName%"
         Value: "/Event/EventData/Data[@Name=\"ActionName\"]"
   -
     Property: PayloadData3
-    PropertyValue: Instance Id: %TaskInstanceId%
+    PropertyValue: "Instance Id: %TaskInstanceId%"
     Values: 
       - 
         Name: TaskInstanceId

diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_201.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_201.map
@@ -5,7 +5,7 @@ Channel: "Microsoft-Windows-TaskScheduler/Operational"
 Maps: 
   - 
     Property: PayloadData1
-PropertyValue: "Task: %TaskName%"
+    PropertyValue: "Task: %TaskName%"
     Values: 
       - 
         Name: TaskName
@@ -19,7 +19,7 @@ PropertyValue: "Task: %TaskName%"
         Value: "/Event/EventData/Data[@Name=\"ActionName\"]"
   -
     Property: PayloadData3
-    PropertyValue: Instance Id: %TaskInstanceId%
+    PropertyValue: "Instance Id: %TaskInstanceId%"
     Values: 
       - 
         Name: TaskInstanceId

diff --git a/evtx/Maps/Security_1102.map b/evtx/Maps/Security_1102.map
@@ -15,7 +15,7 @@ Maps:
         Value: "/Event/UserData/LogFileCleared/SubjectUserName"
   - 
     Property: PayloadData1
-PropertyValue: "SID: (%SubjectUserSid%)"
+    PropertyValue: "SID: (%SubjectUserSid%)"
     Values: 
       - 
         Name: SubjectUserSid

diff --git a/evtx/Maps/Security_5140.map b/evtx/Maps/Security_5140.map
@@ -25,7 +25,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"IpPort\"]"
   - 
     Property: PayloadData1
-    PropertyValue: Share: %ShareName% (%ShareLocalPath%)
+    PropertyValue: "Share: %ShareName% (%ShareLocalPath%)"
     Values: 
       - 
         Name: ShareName
@@ -35,7 +35,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"ShareLocalPath\"]"
   - 
     Property: PayloadData2
-    PropertyValue: Sid: %SubjectUserSid%
+    PropertyValue: "Sid: %SubjectUserSid%"
     Values: 
       - 
         Name: SubjectUserSid

diff --git a/evtx/Maps/System_1.map b/evtx/Maps/System_1.map
@@ -6,21 +6,21 @@ Provider: "Microsoft-Windows-Power-Troubleshooter"
 Maps: 
   - 
     Property: PayloadData1
-    PropertyValue: Sleep duration: "%SleepDuration%"
+    PropertyValue: "Sleep duration: %SleepDuration%"
     Values: 
       - 
         Name: SleepDuration
         Value: "/Event/EventData/Data[@Name=\"SleepDuration\"]"
   - 
     Property: PayloadData2
-    PropertyValue: Wake source: "%WakeSourceType%"
+    PropertyValue: "Wake source: %WakeSourceType%"
     Values: 
       - 
         Name: WakeSourceType
         Value: "/Event/EventData/Data[@Name=\"WakeSourceType\"]"
   - 
     Property: PayloadData3
-    PropertyValue: Wake source text "%WakeSourceText%"
+    PropertyValue: "Wake source text %WakeSourceText%"
     Values: 
       - 
         Name: WakeSourceText