From 62273d573fdbf78d60490cfbfefee0b38e3008aa Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Fri, 31 Jan 2025 19:34:40 -0500
Subject: [PATCH] Update
 o365_email_send_and_hard_delete_exfiltration_behavior.yml

---
 .../o365_email_send_and_hard_delete_exfiltration_behavior.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
index b5c7892357..27f6cccdc7 100644
--- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
+++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
@@ -61,7 +61,7 @@ rba:
     score: 40
   threat_objects:
   - field: subject
-    type: signature    
+    type: email_subject    
 tags:
   analytic_story: 
   - Office 365 Account Takeover