From b5cf28dff531f720ae46847229f17500784eb65b Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 14 Oct 2022 11:13:52 +0200
Subject: [PATCH] Update windows_mshta_execution_in_registry.yml

---
 detections/endpoint/windows_mshta_execution_in_registry.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml
index e680ae157a..9a3307a7be 100644
--- a/detections/endpoint/windows_mshta_execution_in_registry.yml
+++ b/detections/endpoint/windows_mshta_execution_in_registry.yml
@@ -41,7 +41,7 @@ tags:
   - Source:Endpoint
   - Stage:Persistence
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon2.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon3.log
   impact: 80
   kill_chain_phases:
   - Exploitation