From 3dfc308ff2bc9617d41fb8d840a7bf5d539cedb7 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 23 May 2023 16:27:17 +0200
Subject: [PATCH] Update chcp_command_execution.yml

---
 detections/endpoint/chcp_command_execution.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml
index 639afc2d6a..34ab84eb4b 100644
--- a/detections/endpoint/chcp_command_execution.yml
+++ b/detections/endpoint/chcp_command_execution.yml
@@ -12,7 +12,7 @@ data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com
-  Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) by  Processes.process_name
+  Processes.parent_process_name = cmd.exe (Processes.parent_process=* /c * OR Processes.parent_process=* /k *) by  Processes.process_name
   Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id
   Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`'