From 16a9e7c3af41d604cd0ea2d94a73bc25bbfe35e5 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 5 Jul 2022 15:36:27 +0200
Subject: [PATCH] Update windows_remote_services_allow_rdp_in_firewall.yml

---
 .../endpoint/windows_remote_services_allow_rdp_in_firewall.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
index 7fa6ad7cde..8f1397be06 100644
--- a/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
+++ b/detections/endpoint/windows_remote_services_allow_rdp_in_firewall.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic is to identify a modification in the Windows firewall
-  to enable remoted desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
+  to enable remote desktop protocol on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
   to remotely access the compromised or targeted host by allowing this protocol in firewall. Even this protocol might be allowed in some 
   production environment, This TTP behavior is a good pivot to check who and why the user want to enable this feature through firewall which is also common traits 
   of attack to start lateral movement.