From 58afccb2f3ccb7c59ea5fd01a32c26fd57efb64e Mon Sep 17 00:00:00 2001
From: Thomas Patzke <thomas.patzke2@thyssenkrupp.com>
Date: Wed, 8 Aug 2018 15:58:19 +0200
Subject: [PATCH] Fixed ATT&CK tagging

---
 rules/network/net_susp_dns_txt_exec_strings.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/rules/network/net_susp_dns_txt_exec_strings.yml b/rules/network/net_susp_dns_txt_exec_strings.yml
index 8080e09b9..8b768fd91 100644
--- a/rules/network/net_susp_dns_txt_exec_strings.yml
+++ b/rules/network/net_susp_dns_txt_exec_strings.yml
@@ -5,8 +5,7 @@ references:
     - https://twitter.com/stvemillertime/status/1024707932447854592
     - https://github.com/samratashok/nishang/blob/master/Backdoors/DNS_TXT_Pwnage.ps1
 tags:
-    - attack.standard_application_layer_protocol
-    - attack.T1071
+    - attack.t1071
 author: Markus Neis
 date: 2018/08/08
 logsource: