From ce5de3ee808317ec564ab1b5335df09db1216ef2 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 15 Mar 2022 17:13:26 -0400
Subject: [PATCH] adding asset_type

---
 ...erberos_service_ticket_request_using_rc4_encryption.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
index 949e41dee4..3e9d0b3588 100644
--- a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
+++ b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
@@ -32,7 +32,7 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.001/impacket/windows-security.log
   kill_chain_phases:
-  - Privilege Escalation
+  - Exploitation
   mitre_attack_id:
   - T1558
   - T1558.001
@@ -55,9 +55,10 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: 
+  message: A Kerberos Service TTicket request with RC4 encryption was requested from $Client_Address$
   observable:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  asset_type: Endpoint
\ No newline at end of file