From faf0c4e59d151b19bc21f7dffc4e642b0638534c Mon Sep 17 00:00:00 2001
From: Reedtechno <32937591+Reedtechno@users.noreply.github.com>
Date: Thu, 6 Feb 2020 16:54:03 -0500
Subject: [PATCH] Fix Table formatting

Markdown formatting for Indicator/Can it be changed table was incorrect.
---
 install-and-configuration.md | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/install-and-configuration.md b/install-and-configuration.md
index 9aeb70e..98dfea3 100644
--- a/install-and-configuration.md
+++ b/install-and-configuration.md
@@ -561,14 +561,14 @@ This does not mean that an attacker will not use more advanced methods to enumer
 
 Detection of Sysmon is achieved by looking at the areas that cannot be changed.
 
-  **Indicator**                **Can it be Changed**
-  ---------------------------- -----------------------
-  Driver Name                  YES
-  Service Name                 YES
-  Registry Config Path         YES
-  Driver altitude Number       NO
-  EventLog Path and Name       NO
-  Sysmon Service Description   NO (Manually)
+  **Indicator**               | **Can it be Changed**
+  ----------------------------| -----------------------
+  |Driver Name|                  YES
+  |Service Name|                 YES
+  |Registry Config Path|         YES
+  |Driver altitude Number|       NO
+  |EventLog Path and Name|       NO
+  |Sysmon Service Description|   NO (Manually)
 
 When Sysmon configuration is modified using the Sysmon command line tool, an **EventId 16** is generated. If the registry binary value is modified directly, no event is generated, and configuration is applied as soon as the value is modified.