valleyrat

splunk · Sep 18, 2024 · 27e28cd · 27e28cd
1 parent 7db9f58
commit 27e28cd
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/detections/endpoint/windows_schedule_tasks_for_compmgmtlauncher_or_eventvwr.yml b/detections/endpoint/windows_schedule_tasks_for_compmgmtlauncher_or_eventvwr.yml
@@ -53,5 +53,5 @@ tests:
 - name: True Positive Test
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053/valleyrat_schedtask/valleyrat_schedtask.log
-    source: WinEventLog:Security
-    sourcetype: WinEventLog
+    source: XmlWinEventLog:Security
+    sourcetype: XmlWinEventLog