TR-3867

detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml

@@ -49,7 +49,7 @@ tags:
   - T1535
   observable:
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: src_ip

detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml

@@ -56,7 +56,7 @@ tags:
   - T1078.004
   observable:
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   product:

detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml

@@ -38,7 +38,7 @@ tags:
   - T1558.004
   observable:
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   product:

detections/endpoint/windows_alternate_datastream___base64_content.yml

@@ -49,7 +49,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: file_name

detections/endpoint/windows_alternate_datastream___executable_content.yml

@@ -44,7 +44,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
 

detections/endpoint/windows_alternate_datastream___process_execution.yml

@@ -49,7 +49,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: process_name

detections/endpoint/windows_uac_bypass_suspicious_child_process.yml

@@ -54,7 +54,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: process_name

detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml

@@ -66,7 +66,7 @@ tags:
     role:
     - Victim
   - name: user
-    type: User Name
+    type: User
     role:
     - Victim
   - name: process_name