Merge branch 'release_v4.33.1' into 'develop'

v4.33.0 - BUg fixes

See merge request threat-research/security_content!1543

detections/application/crushftp_server_side_template_injection.yml

@@ -27,7 +27,7 @@ tags:
   impact: 80
   message: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability on $dest$ by $src_ip$.
   mitre_attack_id:
-  - T1192
+  - T1190
   observable:
   - name: dest
     type: IP Address

detections/endpoint/living_off_the_land_detection.yml

@@ -25,7 +25,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type
   All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where
-  source_count >= 5 | `living_off_the_land_filter`'
+  source_count >= 5 | `living_off_the_land_detection_filter`'
 how_to_implement: To implement this correlation search a user needs to enable all
   detections in the Living Off The Land Analytic Story and confirm it is generating
   risk events. A simple search `index=risk analyticstories="Living Off The Land"`