Update rules/cross-platform/credential_access_forced_authentication_p…

…ipes.toml

rules/cross-platform/credential_access_forced_authentication_pipes.toml

@@ -57,7 +57,7 @@ type = "eql"
 
 query = '''
 sequence with maxspan=15s
-[network where host.os.type == "linux" and event.action == "connection_attempted" and destination.port == 445 and not startswith~(string(destination.ip), string(host.ip)) ] by host.ip, data_stream.namespace
+[network where host.os.type == "linux" and event.action == "connection_attempted" and destination.port == 445 and not startswith~(string(destination.ip), string(host.ip))] by host.ip, data_stream.namespace
 [file where host.os.type == "windows" and event.code == "5145" and file.name : ("Spoolss", "netdfs", "lsarpc", "lsass", "netlogon", "samr", "efsrpc", "FssagentRpc")] by source.ip, data_stream.namespace
 '''