From 0bc4b38406d95f83cedfaaef4c43318398602781 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Thu, 28 Jul 2022 14:51:06 -0700
Subject: [PATCH] Analytic was referencing a CIM field that did not exist. 
 Fixed that field to reference the intended field.

---
 detections/endpoint/suspicious_process_file_path.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml
index 40cedea8de..2b157e022b 100644
--- a/detections/endpoint/suspicious_process_file_path.yml
+++ b/detections/endpoint/suspicious_process_file_path.yml
@@ -14,9 +14,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*"
   OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*"
-  OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path
-  = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*"
-  OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path
+  OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path
+  = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path = "*\\Windows\\servicing\\*"
+  OR Processes.process_path = "*\\Users\\Default\\*" OR Processes.process_path
   = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path
   = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path
   = "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path
@@ -32,7 +32,7 @@ references:
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 tags:
   analytic_story:
-  - Data Destruction 
+  - Data Destruction
   - Double Zero Destructor
   - XMRig
   - Remcos