zeek, swap path and name

rules/network/zeek/zeek_smb_converted_win_atsvc_task.yml

@@ -16,8 +16,8 @@ logsource:
     service: smb_files
 detection:
     selection:
-        name: \\*\IPC$
-        path: atsvc
+        path: \\*\IPC$
+        name: atsvc
         #Accesses: '*WriteData*'
     condition: selection
 falsepositives:

rules/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml

@@ -13,8 +13,8 @@ logsource:
     service: smb_files
 detection:
   selection:
-    name: '\\*ADMIN$'
-    path: '*SYSTEM32\\*.tmp'
+    path: '\\*ADMIN$'
+    name: '*SYSTEM32\\*.tmp'
   condition: selection
 falsepositives:
     - 'unknown'

rules/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml

@@ -14,10 +14,10 @@ logsource:
     service: smb_files
 detection:
     selection1:
-        name: \\*\IPC$
+        path: \\*\IPC$
     selection2:
-        name: \\*\IPC$
-        path:
+        path: \\*\IPC$
+        name:
          - 'atsvc'
          - 'samr'
          - 'lsarpc'

rules/network/zeek/zeek_smb_converted_win_susp_psexec.yml

@@ -13,8 +13,8 @@ logsource:
     service: smb_files
 detection:
     selection1:
-        name: \\*\IPC$
-        path:
+        path: \\*\IPC$
+        name:
          - '*-stdin'
          - '*-stdout'
          - '*-stderr'

rules/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml

@@ -11,7 +11,7 @@ logsource:
   service: smb_files
 detection:
   selection:
-    path:
+    name:
       - '*.pst'
       - '*.ost'
       - '*.msg'

rules/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml

@@ -13,7 +13,7 @@ logsource:
   service: smb_files
 detection:
   selection:
-    path:
+    name:
       - '\mimidrv'
       - '\lsass'
       - '\windows\minidump\'