Skip to content

Commit 658c2e6

Browse files
authored
Update windows_service_created_with_suspicious_service_name.yml
1 parent e0bb7ec commit 658c2e6

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

detections/endpoint/windows_service_created_with_suspicious_service_name.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,9 @@ rba:
4949
score: 75
5050
threat_objects:
5151
- field: process
52-
type: file_name
52+
type: process
5353
- field: object_name
54-
type: object_name
54+
type: signature
5555
tags:
5656
analytic_story:
5757
- Active Directory Lateral Movement
@@ -76,4 +76,4 @@ tests:
7676
attack_data:
7777
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/sliver/sliver_windows-system.log
7878
source: XmlWinEventLog:System
79-
sourcetype: XmlWinEventLog
79+
sourcetype: XmlWinEventLog

0 commit comments

Comments
 (0)