Minor corrections

AndrewRathbun · AndrewRathbun · commit eea40b813862 · 2020-12-27T08:55:51.000-05:00
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4658.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4658.map
@@ -19,7 +19,7 @@ Maps:
     PropertyValue: "%ProcessName% (PID: %ProcessId%)"
     Values: 
       - 
-        Name: Process
+        Name: ProcessName
         Value: "/Event/EventData/Data[@Name=\"ProcessName\"]"
       - 
         Name: ProcessId
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4672.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4672.map
@@ -19,7 +19,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"SubjectUserSid\"]"
   - 
     Property: PayloadData1
-    PropertyValue: "%PrivilegeList%"
+    PropertyValue: "PrivilegeList: %PrivilegeList%"
     Values: 
       - 
         Name: PrivilegeList
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4673.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4673.map
@@ -29,7 +29,7 @@ Maps:
         Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"      
   - 
     Property: PayloadData1
-    PropertyValue: "%PrivilegeList%"
+    PropertyValue: "PrivilegeList: %PrivilegeList%"
     Values: 
       - 
         Name: PrivilegeList
diff --git a/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4696.map b/evtx/Maps/Security_Microsoft-Windows-Security-Auditing_4696.map
@@ -22,7 +22,7 @@ Maps:
     PropertyValue: "%ProcessName% (PID: %ProcessId%)"
     Values: 
       - 
-        Name: Process
+        Name: ProcessName
         Value: "/Event/EventData/Data[@Name=\"ProcessName\"]"
       - 
         Name: ProcessId

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ Maps:`
`19`	`19`	`PropertyValue: "%ProcessName% (PID: %ProcessId%)"`
`20`	`20`	`Values:`
`21`	`21`	`-`
`22`		`- Name: Process`
	`22`	`+ Name: ProcessName`
`23`	`23`	`Value: "/Event/EventData/Data[@Name=\"ProcessName\"]"`
`24`	`24`	`-`
`25`	`25`	`Name: ProcessId`
Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,7 @@ Maps:`
`29`	`29`	`Value: "/Event/EventData/Data[@Name=\"ProcessId\"]"`
`30`	`30`	`-`
`31`	`31`	`Property: PayloadData1`
`32`		`- PropertyValue: "%PrivilegeList%"`
	`32`	`+ PropertyValue: "PrivilegeList: %PrivilegeList%"`
`33`	`33`	`Values:`
`34`	`34`	`-`
`35`	`35`	`Name: PrivilegeList`
Original file line number	Diff line number	Diff line change
`@@ -22,7 +22,7 @@ Maps:`
`22`	`22`	`PropertyValue: "%ProcessName% (PID: %ProcessId%)"`
`23`	`23`	`Values:`
`24`	`24`	`-`
`25`		`- Name: Process`
	`25`	`+ Name: ProcessName`
`26`	`26`	`Value: "/Event/EventData/Data[@Name=\"ProcessName\"]"`
`27`	`27`	`-`
`28`	`28`	`Name: ProcessId`