From 195db41ce0c81157df9690ff99bb75d5f83edcba Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 6 Jun 2023 07:36:03 -0600
Subject: [PATCH] Update windows_moveit_transfer_writing_aspx.yml

---
 detections/endpoint/windows_moveit_transfer_writing_aspx.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml
index dd5d06e9e2..143ad61929 100644
--- a/detections/endpoint/windows_moveit_transfer_writing_aspx.yml
+++ b/detections/endpoint/windows_moveit_transfer_writing_aspx.yml
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
   tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\MOVEitTransfer\\wwwroot\\*") Filesystem.file_name
-  IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN (human2.aspx) by _time span=1h Filesystem.dest Filesystem.file_create_time
+  IN("*.aspx", "*.ashx", "*.asp*") OR Filesystem.file_name IN ("human2.aspx","_human2.aspx") by _time span=1h Filesystem.dest Filesystem.file_create_time
   Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
   fields _time dest file_create_time file_name file_path process_name process_path
   process] | dedup file_create_time | table dest file_create_time, file_name, file_path,