diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index 4f146516a3..2ed8cac06d 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -9,7 +9,8 @@ datamodel:
 description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify suspicious PowerShell execution. Script Block Logging captures the command
   sent to PowerShell, the full command to be executed. Upon enabling, logs will output
-  to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \
+  to Windows event logs. Dependent upon volume, enable no critical endpoints or all. 
+  \
 
   This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in
   script block. This will catch the most basic use cases for credentials being taken for offline cracking. \