Merge pull request #12 from qlemaire/patch-1

EricZimmerman · web-flow · commit 242891f08f04 · 2019-09-02T07:09:23.000-05:00
Fix typo within "[...]-5861.map"
diff --git a/evtx/Maps/Microsoft-Windows-WMI-Activity_Operational_5861.map b/evtx/Maps/Microsoft-Windows-WMI-Activity_Operational_5861.map
@@ -12,7 +12,7 @@ Maps:
         Value: "/Event/UserData/Operation_ESStoConsumerBinding/ESS"
   - 
     Property: PayloadData2
-    PropertyValue: "%ESS%"
+    PropertyValue: "%PossibleCause%"
     Values: 
       - 
         Name: PossibleCause

Original file line number	Diff line number	Diff line change
`@@ -12,7 +12,7 @@ Maps:`
`12`	`12`	`Value: "/Event/UserData/Operation_ESStoConsumerBinding/ESS"`
`13`	`13`	`-`
`14`	`14`	`Property: PayloadData2`
`15`		`- PropertyValue: "%ESS%"`
	`15`	`+ PropertyValue: "%PossibleCause%"`
`16`	`16`	`Values:`
`17`	`17`	`-`
`18`	`18`	`Name: PossibleCause`