From bea219761252e370e0262a97ff0eba4cf06e8100 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 28 Jan 2022 18:05:34 +0100
Subject: [PATCH] Update disabling_defender_services.yml

---
 detections/endpoint/disabling_defender_services.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml
index 2d6bd68779..16549d8fcf 100644
--- a/detections/endpoint/disabling_defender_services.yml
+++ b/detections/endpoint/disabling_defender_services.yml
@@ -14,7 +14,7 @@ description: This particular behavior is typically executed when an adversaries
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry 
   where Registry.registry_path = "*\\System\\CurrentControlSet\\Services\\*" AND (Registry.registry_path IN("*WdBoot*", "*WdFilter*", "*WdNisDrv*", "*WdNisSvc*","*WinDefend*", "*SecurityHealthService*"))  
   AND Registry.registry_value_name = Start Registry.registry_value_data = 0x00000004 
-  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid Registry.registry_value_data
+  by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_value_data Registry.process_guid 
   | `drop_dm_object_name(Registry)` 
   |rename process_guid as proc_guid |join proc_guid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_guid