Update detect_remote_access_software_usage_file.yml

nterl0k · web-flow · commit 0885f557bb49 · 2025-02-06T08:03:56.000-05:00
diff --git a/detections/endpoint/detect_remote_access_software_usage_file.yml b/detections/endpoint/detect_remote_access_software_usage_file.yml
@@ -71,6 +71,8 @@ rba:
   threat_objects:
   - field: file_name
     type: file_name
+  - field: signature
+    type: signature
 tags:
   analytic_story:
   - Insider Threat
