From d5c67eb50789c1538b52f199508a370ac36eea88 Mon Sep 17 00:00:00 2001
From: "@" <@>
Date: Fri, 23 Oct 2020 15:50:53 -0500
Subject: [PATCH] revert format change

---
 Tactics/CredentialAccess.md | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/Tactics/CredentialAccess.md b/Tactics/CredentialAccess.md
index 914c319..2408126 100644
--- a/Tactics/CredentialAccess.md
+++ b/Tactics/CredentialAccess.md
@@ -55,11 +55,7 @@ Atomics: [T1552.006](https://github.com/redcanaryco/atomic-red-team/blob/master/
 Detection focuses on sysvol GP Policy xml file enumeration, with findstr or Get-GPPPassword (Alias or CmdScript internal match).
 
 `
-TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR
-
-TgtProcCmdline ContainsCIS "Get-GPPPassword" OR
-
-SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'"
+TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR TgtProcCmdline ContainsCIS "Get-GPPPassword" OR SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'"
 `
 
 ### T1558.003 Kerberoasting