From fe7817f28afc5108c547534f8b127fa2daa7ceea Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 29 Nov 2021 13:43:41 -0700
Subject: [PATCH] Update detect_html_help_renamed.yml

Fixing issue #1849
---
 detections/endpoint/detect_html_help_renamed.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 22dce62ed2..93840b2101 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -20,7 +20,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest
   Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_html_help_renamed_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information