Update add_or_set_windows_defender_exclusion.yml

detections/endpoint/add_or_set_windows_defender_exclusion.yml

@@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic will detect a suspicious process commandline related to
-  windows defender exclusion feature. This command is abused by adversaries, malware
-  author and red teams to bypassed Windows Defender Anti-Virus product by excluding  folder
-  path, file path, process, extensions and etc. from its real time or schedule scan
-  to execute their malicious code. This is a good indicator for defense evasion and
+description: This analytic will detect a suspicious process command-line related to windows defender exclusion feature. 
+  This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products 
+  by excluding folder path, file path, process, extensions and etc. 
+  From its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and
   to look further for events after this behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference