fix identation

hal308 · Dec 11, 2020 · 612008a · 612008a
1 parent edc79a8
commit 612008a
Showing 1 changed file with 7 additions and 7 deletions.
diff --git a/rules/windows/process_creation/win_susp_shell_spawn_from_mssql.yml b/rules/windows/process_creation/win_susp_shell_spawn_from_mssql.yml
@@ -15,12 +15,12 @@ logsource:
     product: windows
 detection:
     selection:
-      ParentImage: '*\sqlservr.exe'
-      Image:
-              - '*\cmd.exe'
-              - '*\sh.exe'
-              - '*\bash.exe'
-              - '*\powershell.exe'
-              - '*\bitsadmin.exe'
+        ParentImage: '*\sqlservr.exe'
+        Image:
+            - '*\cmd.exe'
+            - '*\sh.exe'
+            - '*\bash.exe'
+            - '*\powershell.exe'
+            - '*\bitsadmin.exe'
     condition: selection
 level: critical