From 76fa90dd680ee2235699a4ac903ecb8bbf890a47 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 22 Jun 2023 14:22:01 +0200
Subject: [PATCH] Update executables_or_script_creation_in_suspicious_path.yml

---
 .../executables_or_script_creation_in_suspicious_path.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index e89c962946..6e9714e6eb 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -5,10 +5,10 @@ date: '2023-04-25'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: This analytic will identify suspicious executable or scripts (known file
-  extensions) in a list of suspicious file paths in Windows. This technique is used
-  by adversaries to evade detection. The suspicious file path are known paths used
-  in the wild and are not common to have executable or scripts.
+description: This analytic identifies potentially malicious executables or scripts by examining a list of suspicious file paths on Windows Operating System. 
+  The purpose of this technique is to uncover files with known file extensions that could be used by adversaries to evade detection and persistence. 
+  The suspicious file paths selected for investigation are typically uncommon and uncommonly associated with executable or script files. 
+  By scrutinizing these paths, we can proactively identify potential security threats and enhance overall system security.
 data_source:
 - Sysmon Event ID 11
 search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) as