diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml
index fd645db9eb..e3109692be 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell.yml
@@ -1,4 +1,4 @@
-name: GetNetTcpconnection with PowerShell 
+name: GetNetTcpconnection with PowerShell
 id: e02af35c-1de5-4afe-b4be-f45aba57272b
 version: 1
 date: '2021-08-25'
@@ -7,13 +7,15 @@ type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
-  utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections.
-  Red Teams and adversaries alike may use this commandlet for situational awareness and Active Directory Discovery.
+  utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection`
+  commandlet lists the current TCP connections. Red Teams and adversaries alike may
+  use this commandlet for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") 
-  (Processes.process=*Get-NetTcpConnection*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getnettcpconnection_with_powershell_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
+  (Processes.process=*Get-NetTcpConnection*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `getnettcpconnection_with_powershell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -49,4 +51,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed