From dcd72f2f67a3b736bb6edcb14ec13c05da49f0e2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 10 Aug 2021 14:31:04 -0600
Subject: [PATCH] Update suspicious_msbuild_rename.yml

---
 detections/endpoint/suspicious_msbuild_rename.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 82aa79ab49..4f7d6a469c 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -11,7 +11,7 @@ description: The following analytic identifies renamed instances of msbuild.exe
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=MSBuild.exe AND Processes.process_name!=msbuild.exe)
+  as lastTime from datamodel=Endpoint.Processes where Processes.original_file_name=MSBuild.exe Processes.process_name!=msbuild.exe
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
   | `drop_dm_object_name(Processes)`