From c7deea4971c0af58282f6ff44a373904874bfa59 Mon Sep 17 00:00:00 2001
From: "@" <@>
Date: Fri, 23 Oct 2020 15:50:16 -0500
Subject: [PATCH] formatting update

---
 Tactics/CredentialAccess.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Tactics/CredentialAccess.md b/Tactics/CredentialAccess.md
index d6165e3..914c319 100644
--- a/Tactics/CredentialAccess.md
+++ b/Tactics/CredentialAccess.md
@@ -56,7 +56,9 @@ Detection focuses on sysvol GP Policy xml file enumeration, with findstr or Get-
 
 `
 TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR
+
 TgtProcCmdline ContainsCIS "Get-GPPPassword" OR
+
 SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'"
 `