Branch was auto-updated.

detections/endpoint/suspicious_process_file_path.yml

@@ -14,9 +14,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*"
   OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*"
-  OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path
-  = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*"
-  OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path
+  OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path
+  = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path = "*\\Windows\\servicing\\*"
+  OR Processes.process_path = "*\\Users\\Default\\*" OR Processes.process_path
   = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path
   = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path
   = "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path
@@ -64,8 +64,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Suspicioues process $Processes.process_path.file_path$ running from suspicious
-    location
+  message: Suspicious process $process_name$ running from a suspicious process path- $process_path$ on host- $dest$
   mitre_attack_id:
   - T1543
   observable:
@@ -73,8 +72,8 @@ tags:
     type: Endpoint
     role:
     - Victim
-  - name: Processes.process_path.file_path
-    type: File Name
+  - name: process_path
+    type: Location
     role:
     - Attacker
   product: