From 82ea20ae1df63ebf1fb542b9d74f1dbeb8ed7d17 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 22 Feb 2022 15:00:29 -0800
Subject: [PATCH] Field name changed from process_name to parent_process_name. 
 This should be reviewed to ensure that the TA is parsing the events correctly
 and that this does not change the fundamental meaning of the detection.

---
 .../powershell_remote_thread_to_known_windows_process.yml   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
index bd27bcef1f..fc74b1c859 100644
--- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
+++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml
@@ -1,7 +1,7 @@
 name: Powershell Remote Thread To Known Windows Process
 id: ec102cb2-a0f5-11eb-9b38-acde48001122
-version: 1
-date: '2021-04-19'
+version: 2
+date: '2022-02-22'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,7 +11,7 @@ description: this search is designed to detect suspicious powershell process tha
   CreateRemoteThread. This technique is seen in several malware like trickbot and
   offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to
   execute reverse shell to c2 and download another payload
-search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe")
+search: '`sysmon` EventCode = 8 parent_process_name IN ("powershell_ise.exe", "powershell.exe")
   TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
   | stats  min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
   SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress