Field name changed from process_name to parent_process_name. This should be reviewed to ensure that the TA is parsing the events correctly and that this does not change the fundamental meaning of the detection.

detections/endpoint/powershell_remote_thread_to_known_windows_process.yml

@@ -1,7 +1,7 @@
 name: Powershell Remote Thread To Known Windows Process
 id: ec102cb2-a0f5-11eb-9b38-acde48001122
-version: 1
-date: '2021-04-19'
+version: 2
+date: '2022-02-22'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,7 +11,7 @@ description: this search is designed to detect suspicious powershell process tha
   CreateRemoteThread. This technique is seen in several malware like trickbot and
   offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to
   execute reverse shell to c2 and download another payload
-search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe")
+search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe")
   TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
   | stats  min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
   SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress