From 9b543b4e5edeff25c5d101a3905009d223d59356 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iv=C3=A1n=20A?= <hello@alleksy.com>
Date: Wed, 31 Aug 2022 01:30:50 -0700
Subject: [PATCH] Update svchost_exe_lolbas_execution_process_spawn.yml

fixed line 53 by adding missing $
---
 .../endpoint/svchost_exe_lolbas_execution_process_spawn.yml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
index 90587f65be..09aea2c512 100644
--- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
@@ -50,7 +50,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: Svchost.exe spawned a LOLBAS process on $dest
+  message: Svchost.exe spawned a LOLBAS process on $dest$
   mitre_attack_id:
   - T1053
   - T1053.005