From d075ca883b3fa4a156f705883db265506b7d181c Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 24 Feb 2022 12:31:07 -0800
Subject: [PATCH] Update rubeus_command_line_parameters.yml

minor  change to context
---
 detections/endpoint/rubeus_command_line_parameters.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml
index b3117686de..49b18089a9 100644
--- a/detections/endpoint/rubeus_command_line_parameters.yml
+++ b/detections/endpoint/rubeus_command_line_parameters.yml
@@ -61,7 +61,7 @@ tags:
   risk_score: 36
   context:
   - Source:Endpoint
-  - Stage:PrivilegeEscalation
+  - Stage:Privilege Escalation
   message: Rubeus command line parameters were used on $dest$ 
   observable:
   - name: user
@@ -75,4 +75,4 @@ tags:
   - name: parent_process_name
     type: Parent Process
     role:
-    - Parent Process
\ No newline at end of file
+    - Parent Process