From 39131c9974c2e5dfbe83bc37aa44ab071081e040 Mon Sep 17 00:00:00 2001
From: dluxtron <106139814+dluxtron@users.noreply.github.com>
Date: Thu, 6 Jul 2023 14:26:50 +1000
Subject: [PATCH] updating typo

---
 .../endpoint/windows_network_share_discovery_with_net.yml       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_network_share_discovery_with_net.yml b/detections/endpoint/windows_network_share_discovery_with_net.yml
index b979ba567d..51631b61f6 100644
--- a/detections/endpoint/windows_network_share_discovery_with_net.yml
+++ b/detections/endpoint/windows_network_share_discovery_with_net.yml
@@ -8,7 +8,7 @@ type: TTP
 data_source:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log
 description: Network share discovery performed on Windows or MacOS. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe" OR Processes.orig_process_name="net.ex  e") AND (Processes.process="*net*view*" OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe" OR Processes.orig_process_name="net.exe") AND (Processes.process="*net*view*" OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
   Processes.process Processes.parent_process
   | `drop_dm_object_name(Processes)`
   | regex process="net\s+view|net\s+share"