From 144b6971d27baf34cbebf2cab5d4e957d388f3d7 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 24 Nov 2021 10:08:13 -0700
Subject: [PATCH] Update wsmprovhost_exe_lolbas_execution_process_spawn.yml

---
 .../endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
index 02b6c21895..9713a3fb68 100644
--- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
@@ -72,7 +72,7 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: Wsmprovhost.exe spawned a LOLBAS process on $dest
+  message: Wsmprovhost.exe spawned a LOLBAS process on $dest$.
   observable:
   - name: dest
     type: Endpoint