fix logsource

SigmaHQ · Sep 15, 2024 · 1557d7f · 1557d7f
1 parent 3328d51
commit 1557d7f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/process_creation/proc_creation_win_code_devtunnel_tunneling.yml b/rules/windows/process_creation/proc_creation_win_code_devtunnel_tunneling.yml
@@ -12,7 +12,7 @@ tags:
     - attack.t1071
 logsource:
     product: windows
-    service: process_creation
+    category: process_creation
 detection:
     selection_cli:
         Image|endswith: 'code.exe'