Update windows_service_created_with_suspicious_service_path.yml

Updated field names to match, and added dest and user_id to the query for investigation purposes.

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -11,10 +11,10 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa
   alike may create malicious Services for lateral movement or remote code execution
   as well as persistence and execution. The Clop ransomware has also been seen in
   the wild abusing Windows services.
-search: ' `wineventlog_system` EventCode=7045  Service_File_Name = "*.exe" NOT (Service_File_Name
+search: ' `wineventlog_system` EventCode=7045  ImagePath = "*.exe" NOT (ImagePath
   IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*"))
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
-  Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath
+  ServiceName StartType ServiceType dest user_id | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the Service name, Service File Name Service Start type, and Service Type
@@ -40,13 +40,17 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: A service $Service_File_Name$ was created from a non-standard path using
-    $Service_Name$
+  message: A service $ImagePath$ was created from a non-standard path using
+    $ServiceName$
   mitre_attack_id:
   - T1569
   - T1569.002
   observable:
-  - name: Service_File_Name
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: ImagePath
     type: Other
     role:
     - Other
@@ -60,11 +64,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - EventCode
-  - Service_File_Name
-  - Service_Type
+  - ImagePath
+  - ServiceType
   - _time
-  - Service_Name
-  - Service_Start_Type
+  - ServiceName
+  - StartType
+  - dest
   risk_score: 56
   security_domain: endpoint
   asset_type: Endpoint