Update win_account_discovery.yml

jiluhu · Apr 3, 2019 · edb98f2 · edb98f2
1 parent eda5298
commit edb98f2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/windows/builtin/win_account_discovery.yml b/rules/windows/builtin/win_account_discovery.yml
@@ -3,7 +3,7 @@ description: Detect priv users or groups recon based on 4661 eventid and known p
 references:
     - https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
 tags:
-    - attack.account_discovery
+    - attack.discovery
     - attack.t1087
 status: experimental
 author: Samir Bousseaden