From cc164fd251082273930b8307b92dfd39c4ca9fee Mon Sep 17 00:00:00 2001
From: 0xffhh <henri@falconforce.nl>
Date: Tue, 25 Oct 2022 12:48:59 +0200
Subject: [PATCH] Fix annoyance in Sysmon schema where event 10 has a different
 casing for the word GUID.

---
 resources/scripts/ossemSysmonKQLParser.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/resources/scripts/ossemSysmonKQLParser.py b/resources/scripts/ossemSysmonKQLParser.py
index bee0601cc2..98c5b9d750 100644
--- a/resources/scripts/ossemSysmonKQLParser.py
+++ b/resources/scripts/ossemSysmonKQLParser.py
@@ -82,7 +82,7 @@
     for field in fieldlist:
         log.debug('Field Name: {}'.format(field['name']))
         field_name = dict()
-        field_name['name'] = field['name']
+        field_name['name'] = field['name'] if ("GUID" not in field['name']) else field['name'].replace('GUID', 'Guid')
         field_name['index'] = count
         sysmon_event['events'].append(field_name)
         count += 1