From 56559ca9503b5cd46ae2b3182fed9d0524dfb46f Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 26 Apr 2022 15:26:23 +0200
Subject: [PATCH] Update linux_adding_crontab_using_list_parameter.yml

---
 .../endpoint/linux_adding_crontab_using_list_parameter.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
index ca3147fa46..15196aad37 100644
--- a/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
+++ b/detections/endpoint/linux_adding_crontab_using_list_parameter.yml
@@ -6,10 +6,9 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic identifies a suspicious cronjobs modification
-  using crontab list parameter. This commandline parameter can be abuse by malware
-  like industroyer2, adversaries, and red teamers to add cronjob entry to their malicious
-  code to execute to the schedule they want. This event can also be executed by administrator
+description: The following analytic identifies a suspicious cron jobs modification using crontab list parameters. 
+  This command line parameter can be abused by malware like industroyer2, adversaries, and red teamers to add a 
+  crontab entry to their malicious code to execute to the schedule they want. This event can also be executed by administrator
   or normal user for automation purposes so filter is needed.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
   where Processes.process_name = "crontab" Processes.process= "* -l*"