Branch was auto-updated.

detections/endpoint/linux_service_restarted.yml

@@ -6,15 +6,13 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for restarted or re-enable services in linux platform.
-  This technique can be executed or performed using systemctl or service tool application.
-  Adversaries may create or modify Windows services to repeatedly execute malicious
-  payloads as part of persistence. When Windows boots up, it starts programs or applications
-  called services that perform background system functions. Administrator may also
-  create a legitimated service for a specific tool or normal application as part of
-  task or automation, in this scenario it is suggested to look for the service path
-  of the actual script or executable that register as service and who created the
-  service for further verification.
+description: This analytic looks for restarted or re-enable services in the linux platform. 
+  This technique can be executed or performed using systemctl or service tool application. 
+  Adversaries may create or modify Linux services to repeatedly execute malicious payloads as part of persistence. 
+  When the linux host boots up, it starts programs or applications called services that perform background system functions. 
+  Administrator may also create a legitimated service for a specific tool or normal application as part of task or automation, 
+  in this scenario it is suggested to look for the service path of the actual script or executable that registered as service 
+  and who created the service for further verification.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl",
   "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process

detections/endpoint/windows_replication_through_removable_media.yml

@@ -11,7 +11,7 @@ description: This analytic is developed to detect suspicious executable or scrip
   even red teamers to replicate or spread in possible removable drives. Back then, WORM malware was popular 
   for this technique where it would drop a copy of itself in the root drive to be able to spread or to have 
   a lateral movement in other network machines. Nowadays, Ransomware like CHAOS ransomware also use this 
-  technique to spread its malicious code in possible removable drives. Thi TTP detection can be a good 
+  technique to spread its malicious code in possible removable drives. This TTP detection can be a good 
   indicator that a process might create a persistence technique or lateral movement of a targeted machine. 
   We suggest checking the process name that creates this event, the file created, user type, and the reason 
   why that executable or scripts are dropped in the root drive.