diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index 02b6c21895..9713a3fb68 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -72,7 +72,7 @@ tags: context: - Source:Endpoint - Stage:Lateral Movement - message: Wsmprovhost.exe spawned a LOLBAS process on $dest + message: Wsmprovhost.exe spawned a LOLBAS process on $dest$. observable: - name: dest type: Endpoint