From f282ff4b056f6591cec00a0bbde84ff1ecbc7b08 Mon Sep 17 00:00:00 2001
From: Carlos Perez <carlos_perez@darkoperator.com>
Date: Fri, 7 Feb 2020 16:48:40 -0400
Subject: [PATCH] Configuration Example re-format

Re-formatted the configuration example to keep the lines shorter for when exported to PDF and other formats.
---
 create-remote-thread.md | 46 ++++++++++++++++++++++++++++-------------
 1 file changed, 32 insertions(+), 14 deletions(-)

diff --git a/create-remote-thread.md b/create-remote-thread.md
index 026bf13..453908e 100644
--- a/create-remote-thread.md
+++ b/create-remote-thread.md
@@ -69,21 +69,39 @@ Example where known processes that use the API call are excluded
 
 ```xml
 <Sysmon schemaversion="4.22">
-    <CheckRevocation/>
+  <CheckRevocation/>
     <EventFiltering>
-        <RuleGroup name="" groupRelation="or">
-            <CreateRemoteThread onmatch="exclude">
-            <!--The process activity of those in the list should be monitored since an-->
-            <!--attacker may host his actions in one of these to bypass detection.-->
-            <TargetImage condition="end with">Google\Chrome\Application\chrome.exe</TargetImage>
-            <SourceImage condition="is">C:\Windows\System32\wbem\WmiPrvSE.exe</SourceImage>
-            <SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
-            <SourceImage condition="is">C:\Windows\System32\wininit.exe</SourceImage>
-            <SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
-            <SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
-            <SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
-            <SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
-            <StartModule condition="is">C:\windows\system32\kernel32.dll</StartModule>
+      <RuleGroup name="" groupRelation="or">
+        <CreateRemoteThread onmatch="exclude">
+          <!--The process activity of those in the list should be monitored since an-->
+          <!--attacker may host his actions in one of these to bypass detection.-->
+           <TargetImage condition="end with">
+             Google\Chrome\Application\chrome.exe
+            </TargetImage>
+            <SourceImage condition="is">
+              C:\Windows\System32\wbem\WmiPrvSE.exe
+            </SourceImage>
+            <SourceImage condition="is">
+              C:\Windows\System32\svchost.exe
+            </SourceImage>
+            <SourceImage condition="is">
+              C:\Windows\System32\wininit.exe
+            </SourceImage>
+            <SourceImage condition="is">
+              C:\Windows\System32\csrss.exe
+            </SourceImage>
+            <SourceImage condition="is">
+              C:\Windows\System32\services.exe
+            </SourceImage>
+            <SourceImage condition="is">
+              C:\Windows\System32\winlogon.exe
+            </SourceImage>
+            <SourceImage condition="is">
+              C:\Windows\System32\audiodg.exe
+            </SourceImage>
+            <StartModule condition="is">
+              C:\windows\system32\kernel32.dll
+            </StartModule>
         </CreateRemoteThread>
         </RuleGroup>
     </EventFiltering>