From 552e1544e4f634cbb02e2e6436af91f51d2d5a48 Mon Sep 17 00:00:00 2001
From: Austin Songer <austin@songer.pro>
Date: Sat, 14 Aug 2021 22:30:10 -0500
Subject: [PATCH] Update gcp_service_account_modified.yml

---
 rules/cloud/gcp/gcp_service_account_modified.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rules/cloud/gcp/gcp_service_account_modified.yml b/rules/cloud/gcp/gcp_service_account_modified.yml
index 172bcc7bb..7905e5037 100644
--- a/rules/cloud/gcp/gcp_service_account_modified.yml
+++ b/rules/cloud/gcp/gcp_service_account_modified.yml
@@ -11,11 +11,11 @@ logsource:
 detection:
     selection:
         gcp.audit.method_name: 
-            - *.serviceAccounts.patch
-            - *.serviceAccounts.create
-            - *.serviceAccounts.update
-            - *.serviceAccounts.patch
-            - *.serviceAccounts.enable
+            - *serviceAccounts.patch
+            - *serviceAccounts.create
+            - *serviceAccounts.update
+            - *serviceAccounts.patch
+            - *serviceAccounts.enable
     condition: selection
 level: medium
 tags: