Update wmi_recon_running_process_or_services.yml

detections/endpoint/wmi_recon_running_process_or_services.yml

@@ -3,7 +3,7 @@ id: b5cd5526-cce7-11eb-b3bd-acde48001122
 version: 2
 date: '2022-05-02'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel: []
 description: The following analytic identifies suspicious PowerShell script execution
   via EventCode 4104, where WMI is performing an event query looking for running processes
@@ -18,7 +18,7 @@ search: '`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBloc
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: network administrator may used this command for checking purposes
+known_false_positives: Network administrator may used this command for checking purposes
 references:
 - https://news.sophos.com/en-us/2020/05/12/maze-ransomware-1-year-counting/
 - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
@@ -34,7 +34,7 @@ tags:
   - Stage:Recon
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log
-  impact: 30
+  impact: 20
   kill_chain_phases:
   - Reconnaissance
   message: Suspicious powerShell script execution by $user$ on $Computer$ via
@@ -62,6 +62,6 @@ tags:
   - Computer
   - UserID
   - EventCode
-  risk_score: 30
+  risk_score: 20
   security_domain: endpoint
   asset_type: Endpoint