From c5db61e52dcbdff7edeea5883277afcb4e08cc2d Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 28 Jan 2022 12:49:03 -0700
Subject: [PATCH] Quick fix

---
 .../endpoint/potentially_malicious_code_on_commandline.yml  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml
index d1c12f8291..8f1590589b 100644
--- a/detections/endpoint/potentially_malicious_code_on_commandline.yml
+++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml
@@ -60,13 +60,13 @@ tags:
   context:
     - source:endpoint
     - stage:Execution
-  message: Unusual commandline execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
+  message: Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
   observable:
-    - name: ComputerName
+    - name: dest
       type: Hostname
       role:
         - Victim
-    - name: User
+    - name: user
       type: User
       role:
         - Victim
\ No newline at end of file