From 4f42b02fbca2633bf8b9c3e2d706ff9ce4772208 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 15 Jul 2021 09:15:34 +0200
Subject: [PATCH] Update wsreset_uac_bypass.yml

---
 detections/endpoint/wsreset_uac_bypass.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index 389646d37e..e2ae759d0c 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -52,9 +52,9 @@ tags:
   - Stage:Privilege Escalation
   - Stage:Defense Evasion
   - Scope:Incoming
-  message: Suspicious modification of registry $Registry.registry_path$ with possible payload path $Registry.registry_value_name$ in $Registry.dest$
+  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
   observable:
-  - name: Registry.dest
+  - name: dest
     type: Hostname
     role:
     - Victim