Update T1040.yaml

redcanaryco · Feb 4, 2024 · 4afca3b · 4afca3b
1 parent aa448f9
commit 4afca3b
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/atomics/T1040/T1040.yaml b/atomics/T1040/T1040.yaml
@@ -451,9 +451,9 @@ atomic_tests:
     command: |
       New-NetEventSession -Name Capture007 -LocalFilePath "$ENV:Temp\sniff.etl"
       Add-NetEventPacketCaptureProvider -SessionName Capture007 -TruncationLength 100
-	    Start-NetEventSession -Name Capture007
-	    Stop-NetEventSession -Name Capture007
-	    Remove-NetEventSession -Name Capture007
+      Start-NetEventSession -Name Capture007
+      Stop-NetEventSession -Name Capture007
+      Remove-NetEventSession -Name Capture007
     cleanup_command: |-
       del $ENV:Temp\sniff.etl
     name: command_prompt