Merge pull request #13 from bmackalicious/patch-1

Update Security_4648.map - Corrected PayloadData2/3
EricZimmerman · Oct 9, 2019 · b0c92d2 · b0c92d2
2 parents 144356b + c3d389c
commit b0c92d2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/evtx/Maps/Security_4648.map b/evtx/Maps/Security_4648.map
@@ -48,7 +48,7 @@ Maps:
         Name: ProcessName
         Value: "/Event/EventData/Data[@Name=\"ProcessName\"]"
   -
-    Property: PayloadData2
+    Property: PayloadData3
     PropertyValue: "PID: %ProcessId%"
     Values: 
       - 
@@ -95,4 +95,4 @@ Maps:
 #    <Data Name="IpAddress">-</Data>
 #    <Data Name="IpPort">-</Data>
 #  </EventData>
-#</Event>
+#</Event>