From a21deeb7a0277c99fee4eeab056fa285bcff9b38 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 1 Mar 2023 14:05:31 +0100
Subject: [PATCH] Update suspicious_process_file_path.yml

---
 detections/endpoint/suspicious_process_file_path.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml
index 66ff71c302..54754fa371 100644
--- a/detections/endpoint/suspicious_process_file_path.yml
+++ b/detections/endpoint/suspicious_process_file_path.yml
@@ -14,9 +14,9 @@ search: '| tstats `security_content_summariesonly` count values(Processes.proces
   as process_name values(Processes.process) as process min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*"
   OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*"
-  OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path.file_path
-  = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path.file_path = "*\\Windows\\servicing\\*"
-  OR Processes.process_path.file_path = "*\\Users\\Default\\*" OR Processes.process_path.file_path
+  OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path
+  = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path = "*\\Windows\\servicing\\*"
+  OR Processes.process_path = "*\\Users\\Default\\*" OR Processes.process_path
   = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path
   = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path
   = "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path