diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
index adfbca6f7a..762844f608 100644
--- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
+++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is to look for suspicious raw access read to drive where master boot record is place.
+description: This analytic is to look for suspicious raw access read to drive where the master boot record is placed.
   This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code 
   as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector.
 search: '`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*"))