Typo - Powershell Sysmon

[danfoxley]

https://github.com/nsacyber/Mitigating-Web-Shells#powershell-script-to-identify-sysmon-entries-for-iis

Please fix typo:

Get-WinEvent -FilterHashtable @{logname="Micorosft-Windows-Sysmon/Operational";id=1;} | Where {$.message -like "ParentImage: C:\Windows\System32\inetsrv\w3wp.exe"} | %{$.properties[4]} | Sort-Object -Property value -Unique

Corrected (Microsoft)
Get-WinEvent -FilterHashtable @{logname="Microsoft-Windows-Sysmon/Operational";id=1;} | Where {$.message -like "ParentImage: C:\Windows\System32\inetsrv\w3wp.exe"} | %{$.properties[4]} | Sort-Object -Property value -Unique