Update Security_4648.map

PayloadData2 was listed twice - second reference updated to PayloadData3
EricZimmerman · Oct 9, 2019 · c3d389c · c3d389c
1 parent 144356b
commit c3d389c
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/evtx/Maps/Security_4648.map b/evtx/Maps/Security_4648.map
@@ -48,7 +48,7 @@ Maps:
         Name: ProcessName
         Value: "/Event/EventData/Data[@Name=\"ProcessName\"]"
   -
-    Property: PayloadData2
+    Property: PayloadData3
     PropertyValue: "PID: %ProcessId%"
     Values: 
       - 
@@ -95,4 +95,4 @@ Maps:
 #    <Data Name="IpAddress">-</Data>
 #    <Data Name="IpPort">-</Data>
 #  </EventData>
-#</Event>
+#</Event>