From 613374b0c8fc5fd104b4e5d184cfb72a42034798 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 23 Apr 2021 11:39:51 -0600
Subject: [PATCH] Update excessive_usage_of_nslookup_app.yml

---
 detections/endpoint/excessive_usage_of_nslookup_app.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml
index 3a2e971cc2..dd4226f6d4 100644
--- a/detections/endpoint/excessive_usage_of_nslookup_app.yml
+++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml
@@ -6,10 +6,10 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect potential dns exfiltration using nslookup application.
+description: this search is to detect potential DNS exfiltration using nslookup application.
   This technique are seen in couple of malware and APT group to exfiltrated collected
   data in a infected machine or infected network. This detection is looking for unique
-  use of nslookup where it tries to use specific record type like (TXT, A, AAAA) that
+  use of nslookup where it tries to use specific record type (TXT, A, AAAA) that
   are commonly used by attacker and also the retry parameter which is designed to
   query C2 DNS multiple tries.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline