Merge pull request #1302 from splunk/mitre_id_bugs

fix from drew's PR
splunk · Mar 29, 2021 · dd2393e · dd2393e
2 parents 701b445 + d658fec
commit dd2393e
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/detections/endpoint/create_service_in_suspicious_file_path.yml b/detections/endpoint/create_service_in_suspicious_file_path.yml
@@ -29,7 +29,8 @@ tags:
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
-  - T1569.001, T1569.002
+  - T1569.001
+  - T1569.002
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security