diff --git a/atomics/T1040/T1040.yaml b/atomics/T1040/T1040.yaml
index 461d8876ce..1e18cdacbc 100644
--- a/atomics/T1040/T1040.yaml
+++ b/atomics/T1040/T1040.yaml
@@ -451,9 +451,9 @@ atomic_tests:
     command: |
       New-NetEventSession -Name Capture007 -LocalFilePath "$ENV:Temp\sniff.etl"
       Add-NetEventPacketCaptureProvider -SessionName Capture007 -TruncationLength 100
-	    Start-NetEventSession -Name Capture007
-	    Stop-NetEventSession -Name Capture007
-	    Remove-NetEventSession -Name Capture007
+      Start-NetEventSession -Name Capture007
+      Stop-NetEventSession -Name Capture007
+      Remove-NetEventSession -Name Capture007
     cleanup_command: |-
       del $ENV:Temp\sniff.etl
     name: command_prompt