Update microsoft365_email_forwarding_rule_exchange.yml

Remove white spaces
SigmaHQ · Oct 23, 2024 · 2637d5d · 2637d5d
1 parent 1ab6db5
commit 2637d5d
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/rules/cloud/m365/exchange/microsoft365_email_forwarding_rule_exchange.yml b/rules/cloud/m365/exchange/microsoft365_email_forwarding_rule_exchange.yml
@@ -1,5 +1,5 @@
 title: Email Forwarding Rule - Exchange
-id : 332bfab9-170c-40ef-9b11-c8df8d402421
+id: 332bfab9-170c-40ef-9b11-c8df8d402421
 status: experimental
 description: Detects scenarios where an attacker creates or updates a forwarding rules in order to collect information.
 references:
@@ -12,18 +12,18 @@ tags:
     - attack.t1114.003
 logsource:
     service: exchange
-    product: m365  
+    product: m365
 detection:
     selection:
-        Operation: 
+        Operation:
             - 'New-InboxRule'
             - 'Set-InboxRule'
         Parameters.Name:
             - 'ForwardAsAttachmentTo'
             - 'ForwardTo'
             - 'ForwardingAddress'
             - 'RedirectToRecipients'
-            - 'RedirectTo' 
+            - 'RedirectTo'
             - 'ForwardingSmtpAddress'
     condition: selection
 falsepositives: