Merge pull request #6 from kofhearts/patch-1

Fixed syntax error wmi_auditing_local_sub.xml
AustralianCyberSecurityCentre · Feb 5, 2025 · 59041b5 · 59041b5
2 parents 15625db + fd3db00
commit 59041b5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/events/wmi_auditing/wmi_auditing_local_sub.xml b/events/wmi_auditing/wmi_auditing_local_sub.xml
@@ -35,7 +35,7 @@
             <!-- Suppress remote access auditing since it's handled by wmi_remote_sub.xml - WBEM_REMOTE_ACCESS = 32. Limit to <20 OR statements. -->
             *[EventData[band(Data[@Name='AccessMask'], 32)]] or
             
-        <   !-- Suppress common system activity -->
+        <!-- Suppress common system activity -->
             *[EventData[Data[@Name='AdditionalInfo2']='root\cimv2:Select * from __ClassProviderRegistration']] or
             *[EventData[Data[@Name='AdditionalInfo2']='root\cimv2:references of {__Win32Provider.Name=&quot;WmiPerfClass&quot;}']] or
             *[EventData[Data[@Name='AdditionalInfo2']='root\cimv2:references of {__Win32Provider.Name=&quot;CIMWin32&quot;}']] or