From cf9ef65dc118dc4d232738a129124065f42bf77f Mon Sep 17 00:00:00 2001 From: Tomer Alpert Date: Tue, 10 Apr 2018 08:23:55 +0000 Subject: [PATCH] Fix typo --- ...est-practices-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md index de8736b0ff..70648b8b39 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md @@ -75,7 +75,7 @@ ProcessCreationEvents | where ProcessCommandLine == "net stop MpsSvc" | limit 10 -// Better query - filters on filename, does case-insnsitive matches +// Better query - filters on filename, does case-insensitive matches ProcessCreationEvents | where FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc"