From 11ab1d104bbfd332ff810f13ecbf6904a228fe22 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 1 Jun 2022 15:20:15 -0600
Subject: [PATCH] text

---
 ..._command_and_scripting_interpreter_path_traversal_exec.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
index a14cdaa66a..f084d38485 100644
--- a/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
+++ b/detections/endpoint/windows_command_and_scripting_interpreter_path_traversal_exec.yml
@@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies path traversal commandline execution. This technique was seen in malicious document that execute malicious code 
-  using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and commandline 
+description: The following analytic identifies path traversal command-line execution. This technique was seen in malicious document that execute malicious code 
+  using msdt.exe and path traversal technique that serve as defense evasion. This TTP is a good pivot to look for more suspicious process and command-line 
   that runs before and after this execution. This may help you to find possible downloaded malware or other lolbin execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Processes where  Processes.process="*\/..\/..\/..\/*" OR Processes.process="*\\..\\..\\..\\*" OR Processes.process="*\/\/..\/\/..\/\/..\/\/*" by