From bbb9b5a421bb69c4e39ba029278770242e02cd7e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Wed, 1 Mar 2023 10:53:03 -0800 Subject: [PATCH] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index ecbbf1ddad..7bc4fe9bca 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -64,7 +64,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Suspicioues process $Processes.process_path$ running from suspicious + message: Suspicious process $process_name$ running from a suspicious proces path: $process_path$ on host:$dest$ location mitre_attack_id: - T1543