From d4688cc3944594b53a8fd84d64f61ccbabbffbd8 Mon Sep 17 00:00:00 2001
From: miskoSplunk <68617976+miskoSplunk@users.noreply.github.com>
Date: Wed, 18 Nov 2020 10:10:57 -0800
Subject: [PATCH] Update
 ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml

---
 ...and_persistence_opportunities_via_powersploit_modules.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
index b5762cf6ac..76676e1841 100644
--- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
+++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
@@ -42,6 +42,11 @@ eli5: "This detection identifies use of PowerSploit modules that discover access
 known_false_positives:
   "None identified."
 tags:
+  required_fields:
+    - _time
+    - process
+    - dest_device_id
+    - dest_user_id
   cis20:
     - CIS 16
     - CIS 20