diff --git a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml index 7255ea9824..7939e23a88 100644 --- a/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml +++ b/detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml @@ -7,10 +7,10 @@ type: Hunting datamodel: - Endpoint description: The following hunting analytic leverages Event ID 4769, `A Kerberos service ticket was requested`, - to identify an unusual number of computer service tickets request from one source. When a domain joined endpoint connects + to identify an unusual number of computer service ticket requests from one source. When a domain joined endpoint connects to a remote endpoint, it first will request a Kerberos Ticket with the computer name as the Service Name. An endpoint requesting a large number of computer service tickets for different endpoints could represent malicious behavior like - lateral movement, malware staging, reconoissance, etc.\ + lateral movement, malware staging, reconnaissance, etc.\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of service requests. To customize this diff --git a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml index daf51b8e4c..107f9b059f 100644 --- a/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml +++ b/detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml @@ -7,9 +7,9 @@ type: Hunting datamodel: - Endpoint description: The following hunting analytic leverages Event ID 4624, `An account was successfully logged on`, - to identify an unusual number of remote authentication atttemps coming from one source. An endpoint + to identify an unusual number of remote authentication attempts coming from one source. An endpoint authenticating to a large number of remote endpoints could represent malicious behavior like - lateral movement, malware staging, reconoissance, etc.\ + lateral movement, malware staging, reconnaissance, etc.\ The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual high number of authentication events. To customize this