diff --git a/detections/endpoint/windows_system_shutdown_commandline.yml b/detections/endpoint/windows_system_shutdown_commandline.yml
index 3f6f5bf897..32d0824149 100644
--- a/detections/endpoint/windows_system_shutdown_commandline.yml
+++ b/detections/endpoint/windows_system_shutdown_commandline.yml
@@ -5,12 +5,15 @@ date: '2023-06-20'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic identifies Windows commandline to shutdown a windows
-  host machine. This technique was seen in several APT, RAT like dcrat and other commodity
-  malware to shutdown the machine to add more impact, interrupt access, aid destruction
-  of the system like wiping disk or inhibit system recovery. This TTP is a good pivot
-  to check why application trigger this commandline which is not so common way to
-  shutdown a machine.
+description: This detection rule is designed to identify the execution of the Windows shutdown command via command line interface. 
+  The shutdown command can be utilized by system administrators to properly halt, power off, or reboot a computer. 
+  However, in a security context, attackers who have gained unauthorized access to a system may also use this command in an effort to erase tracks, 
+  or to cause disruption and denial of service. In some instances, they might execute the shutdown command after installing a backdoor, 
+  to force the system to restart, ensuring that changes take effect or evading detection by security tools. 
+  Monitoring for the use of the Windows shutdown command, especially in conjunction with other unusual or unauthorized activities, 
+  can be an important part of identifying malicious behavior within a network. 
+  It is advised that security professionals analyze the context in which the shutdown command is being executed to differentiate between 
+  legitimate administrative functions and potentially malicious activity.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process