diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index 2eac23c4b6..98696cc301 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -71,7 +71,7 @@ tags: context: - Source:Endpoint - Stage:Lateral Movement - message: Wmiprsve.exe spawned a LOLBAS process on $dest + message: Wmiprsve.exe spawned a LOLBAS process on $dest$. observable: - name: dest type: Endpoint