From 16d9cedd611d3ea094e4232bc5fc26a51e2882f0 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 2 May 2023 18:08:12 +0200
Subject: [PATCH] Update windows_modify_registry_auto_minor_updates.yml

---
 .../endpoint/windows_modify_registry_auto_minor_updates.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
index 47b2c98444..36d75e0a20 100644
--- a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
+++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog