From 5dc0520ae36cd468cc62cfb088b48c013fda92df Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 16 Jan 2023 15:55:05 +0100
Subject: [PATCH] Update windows_user_execution_malicious_url_shortcut_file.yml

---
 .../windows_user_execution_malicious_url_shortcut_file.yml     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml
index 1c042eb4ee..517ab6f776 100644
--- a/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml
+++ b/detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml
@@ -35,7 +35,8 @@ tags:
   - CIS 16
   confidence: 80
   context:
-  - Update context
+  - Source:Endpoint
+  - Stage:Persistence
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/sysmon.log
   impact: 80