From 385bc45c5d99a352bc5cd2e484dcd2abd91b2503 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Mon, 5 Sep 2022 10:56:24 +0200
Subject: [PATCH] Update windows_phishing_recent_iso_exec_registry.yml

---
 .../endpoint/windows_phishing_recent_iso_exec_registry.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
index 38efa868b9..b82b44feeb 100644
--- a/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
+++ b/detections/endpoint/windows_phishing_recent_iso_exec_registry.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following hunting analytic identifies registry artifacts when a ISO container is opened, clicked or mounted on the Windows operating system.
+description: The following hunting analytic identifies registry artifacts when an ISO container is opened, clicked or mounted on the Windows operating system.
   As Microsoft makes changes to macro based document execution, adversaries have begun to utilize container based initial access based phishing campaigns to evade preventative controls. 
   Once the ISO is clicked or mounted it will create a registry artifact related to this event as a recent application executed or opened.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry