fixed

MHaggis · MHaggis · commit d3d6e624df35 · 2025-05-20T10:43:06.000-06:00
diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml
@@ -78,7 +78,8 @@ tags:
   - Compromised Windows Host
   - Lumma Stealer
   - Living Off The Land
-  - Compromised Windows Host
+  - Suspicious MSHTA Activity
+  - Xworm
   asset_type: Endpoint
   mitre_attack_id:
   - T1218.005
