xmrig2

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -1,4 +1,4 @@
-name: Schtasks Run Task On Demand 
+name: Schtasks Run Task On Demand
 id: bb37061e-af1f-11eb-a159-acde48001122
 version: 1
 date: '2021-05-07'
@@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
-  | `schtasks_run_task_on_demand__filter`'
+  | `schtasks_run_task_on_demand_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the

tests/endpoint/schtasks_run_task_on_demand.test.yml

@@ -1,7 +1,7 @@
-name: Schtasks Run Task On Demand  Unit Test
+name: Schtasks Run Task On Demand Unit Test
 tests:
 - name: Schtasks Run Task On Demand 
-  file: endpoint/schtasks_run_task_on_demand_.yml
+  file: endpoint/schtasks_run_task_on_demand.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'