From cacd61039b4b907bf334bfcc45fc7754e22aea13 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 10 Nov 2020 16:42:51 +0100 Subject: [PATCH] Update windows_security_account_manager_stopped.test.yml --- .../endpoint/windows_security_account_manager_stopped.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/windows_security_account_manager_stopped.test.yml b/tests/endpoint/windows_security_account_manager_stopped.test.yml index 337da0feca..a6d94fcedb 100644 --- a/tests/endpoint/windows_security_account_manager_stopped.test.yml +++ b/tests/endpoint/windows_security_account_manager_stopped.test.yml @@ -1,7 +1,7 @@ name: Windows Security Account Manager Stopped detections: - name: Windows Security Account Manager Stopped - file: detections/endpoint/windows_security_account_manager_stopped.yml + file: endpoint/windows_security_account_manager_stopped.yml pass_condition: '| stats count | where count > 0' - attack_data: file_name: windows-sysmon.log