From f3ca7540f4b4ec25ef05d39e28a690a46a2b67c8 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 27 Jul 2022 15:19:24 -0600
Subject: [PATCH] Update linux_decode_base64_to_shell.yml

---
 detections/endpoint/linux_decode_base64_to_shell.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml
index d87e356c47..21249e50e2 100644
--- a/detections/endpoint/linux_decode_base64_to_shell.yml
+++ b/detections/endpoint/linux_decode_base64_to_shell.yml
@@ -45,7 +45,7 @@ tags:
   - T1059.004
   nist:
   - DE.CM
-   observable:
+  observable:
   - name: user
     type: User
     role: