From 6650542f5abc7abe8a98f514ebb893fcce70c55d Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Thu, 20 Mar 2025 08:13:52 +0100 Subject: [PATCH] bug fix --- ...windows_powershell_script_block_with_malicious_string.yml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml index 7f38345a16..3f127db3a5 100644 --- a/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml +++ b/detections/endpoint/windows_powershell_script_block_with_malicious_string.yml @@ -47,12 +47,9 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: The user $user$ ran a known malicious PowerShell string matching *$match$* + message: The user $user_id$ ran a known malicious PowerShell string matching *$match$* on $dest$ risk_objects: - - field: user - type: user - score: 70 - field: dest type: system score: 70