Skip to content

Commit 2eee405

Browse files
authored
Update detect_certify_with_powershell_script_block_logging.yml
1 parent 391023a commit 2eee405

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

‎detections/endpoint/detect_certify_with_powershell_script_block_logging.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,6 @@ tests:
6464
- name: True Positive Test
6565
attack_data:
6666
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell.log
67-
source: XmlWinEventLog:Security
68-
sourcetype: XmlWinEventLog
69-
update_timestamp: true
67+
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
68+
sourcetype: xmlwineventlog
69+
update_timestamp: true

0 commit comments

Comments
 (0)