diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 68057a7878..ad484f9d34 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -6,9 +6,9 @@ atomicwrites==1.4.0
 attackcti==0.3.3
 attrs==20.3.0
 bcrypt==3.2.0
-botocore==1.19.19
+botocore==1.19.20
 certifi==2019.11.28
-boto3==1.16.19
+boto3==1.16.20
 cffi==1.14.3
 cfgv==2.0.1
 chardet==3.0.4
diff --git a/detections/endpoint/windows_connhost_exe_force_flag.yml b/detections/deprecated/windows_connhost_exe_force_flag.yml
similarity index 86%
rename from detections/endpoint/windows_connhost_exe_force_flag.yml
rename to detections/deprecated/windows_connhost_exe_force_flag.yml
index d238f63107..8abbf3ed30 100644
--- a/detections/endpoint/windows_connhost_exe_force_flag.yml
+++ b/detections/deprecated/windows_connhost_exe_force_flag.yml
@@ -3,7 +3,10 @@ id: c114aaca-68ee-41c2-ad8c-32bf21db8769
 version: 1
 date: '2020-11-06'
 description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. 
-This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware.'
+This is not regular behavior in the Windows OS and is often seen executed by the Ryuk Ransomware. 
+DEPRECATED
+This event is actually seen in the windows 10 client of attack_range_local. After further testing we realized this is not specific to Ryuk.
+'
 how_to_implement: You must be ingesting data that records the process-system activity
   from your hosts to populate the Endpoint Processes data-model object. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which