-
Notifications
You must be signed in to change notification settings - Fork 111
Open
Description
there is "\n" after "SysmonCreateFileTime.txt" in sysmon config file that causes no-working of Event2.
<!-- -eid 2 is Working -->
<FileCreateTime onmatch="include">
<Image name="SysmonSimulator FileCreateTime modification Simulation for SysmonCreateFileTime.txt" condition="end with">SysmonSimulator.exe</Image>
<TargetFilename condition="end with">SysmonCreateFileTime.txt
</TargetFilename>
</FileCreateTime>
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels