From 57178903ca1354bb51b90cf7e5538b4dcadf0524 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Thu, 30 Mar 2023 12:21:48 -0600
Subject: [PATCH] Update windows_vulnerable_3cx_software.yml

---
 detections/endpoint/windows_vulnerable_3cx_software.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/windows_vulnerable_3cx_software.yml b/detections/endpoint/windows_vulnerable_3cx_software.yml
index 0e2ce4cfd1..efea7e4664 100644
--- a/detections/endpoint/windows_vulnerable_3cx_software.yml
+++ b/detections/endpoint/windows_vulnerable_3cx_software.yml
@@ -4,8 +4,7 @@ version: 1
 date: '2023-03-30'
 author: Michael Haag, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic leverages Sysmon, a powerful system monitoring and logging tool, to pinpoint instances of the 3CXDesktopApp.exe with a FileVersion of 18.12.x.Recently, 3CX has discovered a vulnerability specifically in versions 18.12.407 and 18.12.416 of the desktop app.
 search: '`sysmon` (process_name=3CXDesktopApp.exe OR OriginalFileName=3CXDesktopApp.exe)  FileVersion=18.12.* 
   | rename Computer as dest 
@@ -68,4 +67,4 @@ tags:
   - Computer
   - parent_process_name
   risk_score: 90
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint