From e2ea10c2d266c606bfae5caf0931cfcd0e52c604 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Fri, 14 Feb 2025 14:15:20 +0100
Subject: [PATCH] headless_bee

---
 detections/endpoint/windows_anonymous_pipe_activity.yml | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_anonymous_pipe_activity.yml b/detections/endpoint/windows_anonymous_pipe_activity.yml
index 88fbde1c4f..13005f9a71 100644
--- a/detections/endpoint/windows_anonymous_pipe_activity.yml
+++ b/detections/endpoint/windows_anonymous_pipe_activity.yml
@@ -10,7 +10,7 @@ data_source:
 - Sysmon EventID 17
 - Sysmon EventID 18
 search: '`sysmon` EventCode IN (17,18) EventType IN ( "CreatePipe", "ConnectPipe") PipeName="*Anonymous Pipe*" NOT( Image IN ("*\\Program Files\\*"))
-  | stats  min(_time) as firstTime max(_time) as lastTime count by dest user EventCode PipeName process_id process_guid Image EventType 
+  | stats  min(_time) as firstTime max(_time) as lastTime count by dest EventCode PipeName ProcessGuid ProcessId Image EventType 
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
   | `windows_anonymous_pipe_activity_filter`'
@@ -40,9 +40,6 @@ rba:
   - field: dest
     type: system
     score: 30
-  - field: user
-    type: user
-    score: 30
   threat_objects: []
 tags:
   analytic_story: