From f8eeef30e69e3ef536783a277d797a434846ad59 Mon Sep 17 00:00:00 2001
From: reece394 <31659691+reece394@users.noreply.github.com>
Date: Wed, 11 Nov 2026 22:00:05 +0000
Subject: [PATCH 1/2] Implement Fix for Antivirus Rules

---
 rules/evtx/antivirus/f-secure_legacy.yml             | 2 +-
 rules/evtx/antivirus/kaspersky.yml                   | 4 ++--
 rules/evtx/antivirus/mcafee.yml                      | 2 +-
 rules/evtx/antivirus/symantec.yml                    | 2 +-
 rules/evtx/antivirus/windows_security_essentials.yml | 6 +++---
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/rules/evtx/antivirus/f-secure_legacy.yml b/rules/evtx/antivirus/f-secure_legacy.yml
index 626abfac..79731740 100644
--- a/rules/evtx/antivirus/f-secure_legacy.yml
+++ b/rules/evtx/antivirus/f-secure_legacy.yml
@@ -24,7 +24,7 @@ fields:
   - name: Threat Name
     to: Event.EventData.MessageText
   - name: Threat Path
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 filter:
   Event.System.Provider:
diff --git a/rules/evtx/antivirus/kaspersky.yml b/rules/evtx/antivirus/kaspersky.yml
index ca245556..2b39697f 100644
--- a/rules/evtx/antivirus/kaspersky.yml
+++ b/rules/evtx/antivirus/kaspersky.yml
@@ -20,9 +20,9 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Name
-    to: Event.EventData.Data[1]
+    to: Event.EventData.Data.#text[1]
   - name: Threat Path
-    to: Event.EventData.Data[0]
+    to: Event.EventData.Data.#text[0]
 
 
 filter:
diff --git a/rules/evtx/antivirus/mcafee.yml b/rules/evtx/antivirus/mcafee.yml
index 04fd43d2..586c3956 100644
--- a/rules/evtx/antivirus/mcafee.yml
+++ b/rules/evtx/antivirus/mcafee.yml
@@ -20,7 +20,7 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Name
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 filter:
   Event.System.Provider:
diff --git a/rules/evtx/antivirus/symantec.yml b/rules/evtx/antivirus/symantec.yml
index 4bdfe3c6..422e3901 100644
--- a/rules/evtx/antivirus/symantec.yml
+++ b/rules/evtx/antivirus/symantec.yml
@@ -20,7 +20,7 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Name
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 filter:
   Event.System.Provider: Symantec Endpoint Protection Client
diff --git a/rules/evtx/antivirus/windows_security_essentials.yml b/rules/evtx/antivirus/windows_security_essentials.yml
index 88c3bddf..50ad0c70 100644
--- a/rules/evtx/antivirus/windows_security_essentials.yml
+++ b/rules/evtx/antivirus/windows_security_essentials.yml
@@ -20,11 +20,11 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: User
-    to: Event.EventData.Data[19]
+    to: Event.EventData.Data.#text[19]
   - name: Threat Name
-    to: Event.EventData.Data[7]
+    to: Event.EventData.Data.#text[7]
   - name: Threat Path
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 
 filter:

From f2cf00cb762cee84699cbf8b3b23e4b3619c51f6 Mon Sep 17 00:00:00 2001
From: reece394 <31659691+reece394@users.noreply.github.com>
Date: Thu, 12 Nov 2026 19:38:20 +0000
Subject: [PATCH 2/2] Fix Sophos

---
 rules/evtx/antivirus/sophos.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/rules/evtx/antivirus/sophos.yml b/rules/evtx/antivirus/sophos.yml
index 97668b94..87a9d887 100644
--- a/rules/evtx/antivirus/sophos.yml
+++ b/rules/evtx/antivirus/sophos.yml
@@ -20,14 +20,14 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Type
-    to: Event.EventData.Data[0]
+    to: Event.EventData.Data.#text[0]
   - name: Threat Name
-    to: Event.EventData.Data[2]
+    to: Event.EventData.Data.#text[2]
   - name: Threat Path
-    to: Event.EventData.Data[1]
+    to: Event.EventData.Data.#text[1]
   - name: SHA1
     container:
-      field: Event.EventData.Data[4]
+      field: Event.EventData.Data.#text[4]
       format: json
     to: sha1FileHash