Merge pull request #206 from ipfyx/fix_typo

Fix some typos

Author: olafhartong

12_13_14_registry_event/include_office_dde.xml

@@ -4,9 +4,9 @@
 			<RegistryEvent onmatch="include">
 				<!--Microsoft:Office:Security _features-->
 				<!--https://msrc.microsoft.com/update-guide/vulnerability/ADV170021-->
-				<TargetObject name="T1559.002,office" condition="end with">\Word\Security\AllowDDE</TargetObject> 
-				<TargetObject name="T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLaunch</TargetObject>
-				<TargetObject name="T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLookup</TargetObject> 		
+				<TargetObject name="technique_id=T1559.002,office" condition="end with">\Word\Security\AllowDDE</TargetObject> 
+				<TargetObject name="technique_id=T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLaunch</TargetObject>
+				<TargetObject name="technique_id=T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLookup</TargetObject> 		
 			</RegistryEvent>
 		</RuleGroup>
 	</EventFiltering>

12_13_14_registry_event/include_office_security_features.xml

@@ -4,10 +4,10 @@
 			<RegistryEvent onmatch="include">
 				<!--Microsoft:Office:Security _features-->
 				<!--https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry_event/sysmon_disable_microsoft_office_security_features.yml-->
-				<TargetObject name="T1562,office" condition="end with">\VBAWarnings</TargetObject> 
-				<TargetObject name="T1562,office" condition="end with">\DisableInternetFilesInPV</TargetObject>
-				<TargetObject name="T1562,office" condition="end with">\DisableUnsafeLocationsInPV</TargetObject> 
-				<TargetObject name="T1562,office" condition="end with">\DisableAttachementsInPV</TargetObject>				
+				<TargetObject name="technique_id=T1562,office" condition="end with">\VBAWarnings</TargetObject> 
+				<TargetObject name="technique_id=T1562,office" condition="end with">\DisableInternetFilesInPV</TargetObject>
+				<TargetObject name="technique_id=T1562,office" condition="end with">\DisableUnsafeLocationsInPV</TargetObject> 
+				<TargetObject name="technique_id=T1562,office" condition="end with">\DisableAttachementsInPV</TargetObject>				
 			</RegistryEvent>
 		</RuleGroup>
 	</EventFiltering>

17_18_pipe_event/include_cobaltstrike.xml

@@ -7,7 +7,7 @@
         <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="end with">-server</PipeName>        <!-- default cobalt strike pipe name-->
         </Rule>
         <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\msagent_</PipeName>        <!-- default cobalt strike pipe name-->
-        <PipeName name="technique_id=T1055; Possible Cobalt Strike post-exploitation jobs." condition="begin with">\postex_</PipeName>        <!-- default cobalt strike pipe name-->
+        <PipeName name="technique_id=T1055,Possible Cobalt Strike post-exploitation jobs." condition="begin with">\postex_</PipeName>        <!-- default cobalt strike pipe name-->
         <PipeName name="technique_id=T1021.004,technique_name=Remote Services: SSH" condition="begin with">\postex_ssh_</PipeName>        <!-- default cobalt strike pipe name-->
         <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\status_</PipeName>        <!-- default cobalt strike pipe name-->
       </PipeEvent>