From 32dd94c6ef8a61caa9d25e65f6292fef17201605 Mon Sep 17 00:00:00 2001
From: dluxtron <106139814+dluxtron@users.noreply.github.com>
Date: Thu, 8 Sep 2022 18:17:58 +1000
Subject: [PATCH] Adding DCSync Attack

---
 detections/endpoint/dcsync_attack.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml
index 78e328dac5..79c422f953 100644
--- a/detections/endpoint/dcsync_attack.yml
+++ b/detections/endpoint/dcsync_attack.yml
@@ -40,6 +40,7 @@ references:
 tags:
   analytic_story:
   - Domain Controller Attacks
+  - Credential Dumping
   asset_type: Endpoint
   cis20:
   - CIS 3
@@ -60,7 +61,7 @@ tags:
   nist:
   - DE.CM
   observable:
-   - name: src_user
+  - name: src_user
     type: User
     role:
     - Victim