diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
index ca3147fa46..15196aad37 100644
--- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
+++ b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
@@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic identifies a suspicious cronjobs modification
-  using crontab list parameter. This commandline parameter can be abuse by malware
-  like industroyer2, adversaries, and red teamers to add cronjob entry to their malicious
-  code to execute to the schedule they want. This event can also be executed by administrator
+description: The following analytic identifies a suspicious cron jobs modification using crontab list parameters. 
+  This command line parameter can be abused by malware like industroyer2, adversaries, and red teamers to add a 
+  crontab entry to their malicious code to execute to the schedule they want. This event can also be executed by administrator
   or normal user for automation purposes so filter is needed.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
   where Processes.process_name = "crontab" Processes.process= "* -l*"