diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml
index 0d985ab25a..b6ba9d0b2a 100644
--- a/detections/endpoint/sqlite_module_in_temp_folder.yml
+++ b/detections/endpoint/sqlite_module_in_temp_folder.yml
@@ -6,18 +6,19 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder.
-  This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome 
-  or firefox to stole browser information related to bank, credit card or credentials.
-search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*")
-  |stats count min(_time) as firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId Image
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
+description: This search is to detect a suspicious file creation of sqlite3.dll in
+  %temp% folder. This behavior was seen in IcedID malware where it download sqlite
+  module to parse browser database like for chrome or firefox to stole browser information
+  related to bank, credit card or credentials.
+search: '`sysmon` EventCode=11 (TargetFilename = "*\\sqlite32.dll" OR TargetFilename
+  = "*\\sqlite64.dll") (TargetFilename = "*\\temp\\*") |stats count min(_time) as
+  firstTime max(_time) as lastTime by process_name TargetFilename EventCode ProcessId
+  Image | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `sqlite_module_in_temp_folder_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: unknown
 references:
 - https://www.cisecurity.org/white-papers/security-primer-icedid/
@@ -36,22 +37,21 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - process_name 
-  - TargetFilename 
-  - EventCode 
-  - ProcessId 
+  - process_name
+  - TargetFilename
+  - EventCode
+  - ProcessId
   - Image
   security_domain: endpoint
   impact: 30
   confidence: 30
-  # (impact * confidence)/100
   risk_score: 9
   context:
-  - source: endpoint 
+  - source: endpoint
   - stage: Collection
   message: process $SourceImage$ create a file $TargetImage$ in host $Computer$
   observable:
-  - name: Computer 
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -59,4 +59,4 @@ tags:
     type: process name
     role:
     - Attacker
-  
\ No newline at end of file
+  automated_detection_testing: passed