From fd34f91dcd39cb581d6a1423223bfab46ce6690a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 13 Sep 2021 07:34:37 -0600
Subject: [PATCH] Update create_or_delete_windows_shares_using_net_exe.yml

---
 .../endpoint/create_or_delete_windows_shares_using_net_exe.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index 752dd0b286..557e12799f 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for the creation or deletion of hidden shares using
   net.exe.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
   OR Processes.process_name=net1.exe) AND (Processes.process="* share *") by Processes.dest
   Processes.user Processes.parent_process_name Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`