From f986f4a22169699ed4143679eca8f5cc15c218a0 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 2 Feb 2022 13:32:53 -0700
Subject: [PATCH] Update powershell_remove_windows_defender_directory.yml

Resolving https://github.com/splunk/security_content/pull/1962
---
 .../endpoint/powershell_remove_windows_defender_directory.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index d891abf325..fe08533824 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -11,7 +11,7 @@ description: This analytic will identify a suspicious PowerShell command used to
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
-search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows
+search: '`powershell` EventCode=4104 Message = "* rmdir *" AND Message = "*\\Microsoft\\Windows
   Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
   Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_remove_windows_defender_directory_filter`'