From 1b3707932b804fda948261bf1b846e9646ea35fa Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Sun, 31 Jul 2022 16:49:35 -0700
Subject: [PATCH] Fixed known outstanding issue with process_name and
 parent_process_name

---
 .../endpoint/office_document_creating_schedule_task.yml       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml
index 13636ffc50..7dac9b5768 100644
--- a/detections/endpoint/office_document_creating_schedule_task.yml
+++ b/detections/endpoint/office_document_creating_schedule_task.yml
@@ -19,9 +19,9 @@ description: this search detects a potential malicious office document that crea
   source. Was it schtasks.exe or via TaskService? Review the job created and the Command
   to be executed. Capture any artifacts on disk and review. Identify any parallel
   processes within the same timeframe to identify source.'
-search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
+search: '`sysmon` EventCode=7 parent_process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
   ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime
-  values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image process_name
+  values(ImageLoaded) as AllImageLoaded count by Computer EventCode Image parent_process_name
   ProcessId ProcessGuid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `office_document_creating_schedule_task_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting