From c1ba6e150538b8b2e13b60ffb047dc6653a22abc Mon Sep 17 00:00:00 2001
From: Axel-NTT <59650749+Axel-NTT@users.noreply.github.com>
Date: Wed, 17 May 2023 13:46:28 +0200
Subject: [PATCH] Update proxy_ua_bitsadmin_susp_tld.yml to use proxy field

---
 rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml b/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
index 63163d2c4..33ef79677 100644
--- a/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
+++ b/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
@@ -7,7 +7,7 @@ references:
     - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
 author: Florian Roth (Nextron Systems), Tim Shelton
 date: 2019/03/07
-modified: 2022/08/16
+modified: 2023/05/17
 tags:
     - attack.command_and_control
     - attack.t1071.001
@@ -21,7 +21,7 @@ detection:
     selection:
         c-useragent|startswith: 'Microsoft BITS/'
     falsepositives:
-        r-dns|endswith:
+        cs-host|endswith:
             - '.com'
             - '.net'
             - '.org'