From aa7d9edcda8fde52bc82852a82a097e656a0d0e2 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Fri, 2 Aug 2024 08:31:12 -0400
Subject: [PATCH] Update detect_password_spray_attack_behavior_on_user.yml

derp wrong log
---
 .../detect_password_spray_attack_behavior_on_user.yml         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
index f590b22c1c..339965acb8 100644
--- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
+++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml
@@ -59,7 +59,7 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110/003/passwprd_spray_attack/windows_events.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/generic_password_spray/password_spray_attack.log
     source: XmlWinEventLog:Security
     sourcetype: XmlWinEventLog
-    update_timestamp: true
\ No newline at end of file
+    update_timestamp: true