From 044b81b922cb7c54bb5dea421be4b4e9dd5b07e3 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Fri, 21 Jan 2022 09:34:41 +0100
Subject: [PATCH] Update add_or_set_windows_defender_exclusion.yml

---
 .../endpoint/add_or_set_windows_defender_exclusion.yml   | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
index 0bcd25ae26..c62c06ac71 100644
--- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml
+++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml
@@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic will detect a suspicious process commandline related to
-  windows defender exclusion feature. This command is abused by adversaries, malware
-  author and red teams to bypassed Windows Defender Anti-Virus product by excluding  folder
-  path, file path, process, extensions and etc. from its real time or schedule scan
-  to execute their malicious code. This is a good indicator for defense evasion and
+description: This analytic will detect a suspicious process command-line related to windows defender exclusion feature. 
+  This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products 
+  by excluding folder path, file path, process, extensions and etc. 
+  From its real time or schedule scan to execute their malicious code. This is a good indicator for defense evasion and
   to look further for events after this behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process = "*Add-MpPreference