From 097683ffbb02f7f88fe2b5596616bfa408dd6772 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 24 Nov 2021 10:07:35 -0700
Subject: [PATCH] Update wmiprsve_exe_lolbas_execution_process_spawn.yml

---
 .../endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
index 2eac23c4b6..98696cc301 100644
--- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
@@ -71,7 +71,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: Wmiprsve.exe spawned a LOLBAS process on $dest
+  message: Wmiprsve.exe spawned a LOLBAS process on $dest$.
   observable:
   - name: dest
     type: Endpoint