From 545c3dabc559484aa39ff6bfd85c439a7322f088 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 3 Mar 2022 13:24:35 -0700
Subject: [PATCH] Update ssa___windows_script_host_spawn_msbuild.yml

---
 detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
index 1b078d6df1..126120fd65 100644
--- a/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
+++ b/detections/endpoint/ssa___windows_script_host_spawn_msbuild.yml
@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where parent_process_name="wscript.exe" OR parent_process_name="cscript.exe" AND process_name="msbuild.exe"
+  cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT NULL | where (parent_process_name LIKE "%wscript.exe" OR parent_process_name LIKE "%cscript.exe%") AND process_name="msbuild.exe"
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",