From 252ed2576ff3e5bb71c887e6489dd3b443ba1ff4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 16 Feb 2022 14:30:10 -0700
Subject: [PATCH] Update ssa___windows_certutil_urlcache_download.yml

---
 .../endpoint/ssa___windows_certutil_urlcache_download.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
index 244afa2e5d..4d42ecf8c3 100644
--- a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
@@ -5,7 +5,7 @@ date: '2022-02-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: Certutil.exe may download a file from a remote destination using `-urlcache`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will