Merge pull request #17 from randomaccess3/patch-2

Update Microsoft-Windows-TaskScheduler_Operational_200.map
EricZimmerman · Dec 4, 2019 · 4794500 · 4794500
2 parents 6d2824d + cb767c8
commit 4794500
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_200.map b/evtx/Maps/Microsoft-Windows-TaskScheduler_Operational_200.map
@@ -11,8 +11,8 @@ Maps:
         Name: TaskName
         Value: "/Event/EventData/Data[@Name=\"TaskName\"]"
   - 
-    Property: PayloadData2
-    PropertyValue: Action %ActionName%
+    Property: ExecutableInfo
+    PropertyValue: "%ActionName%"
     Values: 
       - 
         Name: ActionName
@@ -55,4 +55,4 @@ Maps:
 #     <Data Name="TaskInstanceId">b4d1e103-abb2-4443-8640-7d7ed3692e7a</Data>
 #     <Data Name="EnginePID">0</Data>
 #   </EventData>
-# </Event>
+# </Event>