Update rules/windows/credential_access_kerberos_coerce.toml

Author: w0rk3r

rules/windows/credential_access_kerberos_coerce.toml

@@ -92,8 +92,8 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-(event.code:4662 and winlog.event_data.AdditionalInfo : *1UWhR*BAAAA,*MicrosoftDNS*) or 
-(event.code:5137 and winlog.event_data.ObjectDN:*1UWhR*BAAAA,*MicrosoftDNS*)
+(event.code:4662 and winlog.event_data.AdditionalInfo: *UWhRC*BAAAA*MicrosoftDNS*) or 
+(event.code:5137 and winlog.event_data.ObjectDN: *UWhRC*BAAAA*MicrosoftDNS*)
 '''