Update executables_or_script_creation_in_suspicious_path.yml

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -5,10 +5,10 @@ date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: This analytic will identify suspicious executable or scripts (known file
-  extensions) in a list of suspicious file paths in Windows. This technique is used
-  by adversaries to evade detection. The suspicious file path are known paths used
-  in the wild and are not common to have executable or scripts.
+description: This analytic identifies potentially malicious executables or scripts by examining a list of suspicious file paths on Windows Operating System. 
+  The purpose of this technique is to uncover files with known file extensions that could be used by adversaries to evade detection and persistence. 
+  The suspicious file paths selected for investigation are typically uncommon and uncommonly associated with executable or script files. 
+  By scrutinizing these paths, we can proactively identify potential security threats and enhance overall system security.
 data_source:
 - Sysmon Event ID 11
 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as