From fb416daa39ec8d66844333958c3f9fc0adfa8ee0 Mon Sep 17 00:00:00 2001
From: Steven Dick <38897662+nterl0k@users.noreply.github.com>
Date: Sat, 4 May 2024 12:19:26 -0400
Subject: [PATCH] Update windows_lolbas_executed_as_renamed_file.yml

---
 .../endpoint/windows_lolbas_executed_as_renamed_file.yml  | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml
index a703812780..b41c548119 100644
--- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml
+++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml
@@ -36,15 +36,15 @@ tags:
   - T1218.011
   observable: 
   - name: dest
-    type: system
+    type: Hostname
     role:
     - Victim
   - name: user
-    type: user
+    type: User
     role:
     - Victim
   - name: process_name
-    type: process_name
+    type: Process Name
     role:
     - Attacker
   product: 
@@ -65,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog