From 8a59b330ae5492e204f4043d2a286d0ec00dd046 Mon Sep 17 00:00:00 2001
From: ljstella <lstella@splunk.com>
Date: Mon, 19 Aug 2024 10:32:38 -0500
Subject: [PATCH] Missed cloud

---
 detections/network/detect_windows_dns_sigred_via_zeek.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/network/detect_windows_dns_sigred_via_zeek.yml
index 6cffde76c0..1290d1c7be 100644
--- a/detections/network/detect_windows_dns_sigred_via_zeek.yml
+++ b/detections/network/detect_windows_dns_sigred_via_zeek.yml
@@ -1,7 +1,7 @@
 name: Detect Windows DNS SIGRed via Zeek
 id: c5c622e4-d073-11ea-87d0-0242ac130003
-version: 2
-date: '2024-05-23'
+version: 3
+date: '2024-08-19'
 author: Shannon Davis, Splunk
 status: experimental
 type: TTP
@@ -32,10 +32,10 @@ tags:
   mitre_attack_id:
   - T1203
   observable:
-  - name: dest
+  - name: flow_id
     type: Other
     role:
-    - Other
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security