diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
index 989bc63449..bda45066af 100644
--- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -12,7 +12,7 @@ description: This search is to detect an anomaly event of a non-chrome process a
   the RAT, trojan spy as well as FIN7 jssloader try to parse the those sqlite database
   to collect information on the compromised host. This SACL Event (4663) need to be
   enabled to tthe firefox profile directory to be eable to use this. Since you monitoring
-  this access to the folder a noise coming from firefox need to be filter and also
+  this access to the folder,  we observed noise that needs to be filter out and hence added
   sqlite db browser and explorer .exe to make this detection more stable.
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\chrome.exe",
   "*\\explorer.exe", "*sql*")) Object_Name="*\\Google\\Chrome\\User Data\\Default*"
@@ -30,6 +30,7 @@ tags:
   - FIN7
   - Remcos
   - AgentTesla
+  - 3CX Supply Chain Attack
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 02678b1579..3947e6383b 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -10,10 +10,10 @@ description: This search is to detect an anomaly event of a non-firefox process
   the files in the profile folder. This folder contains all the sqlite database of the
   firefox browser related to users login, history, cookies and etc. Most of the RAT,
   trojan spy as well as FIN7 jssloader try to parse the those sqlite database to collect
-  information on the compromised host. This SACL Event (4663) need to be enabled to
-  tthe firefox profile directory to be eable to use this. Since you monitoring this
-  access to the folder a noise coming from firefox need to be filter and also sqlite
-  db browser and explorer .exe to make this detection more stable.
+  information on the compromised host. This SACL Event (4663) needs to be enabled to
+  the firefox profile directory to use this. Since this is monitoring the
+  access to the folder, we have obsevered noise and hence added `sqlite
+  db browser` and `explorer.exe` to make this detection more stable.
 search: '`wineventlog_security` EventCode=4663 NOT (process_name IN ("*\\firefox.exe",
   "*\\explorer.exe", "*sql*")) Object_Name="*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles*"
   | stats count min(_time) as firstTime max(_time) as lastTime by Object_Name Object_Type
@@ -31,6 +31,7 @@ tags:
   - Remcos
   - Azorult
   - AgentTesla
+  - 3CX Supply Chain Attack
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/requirements.txt b/requirements.txt
index 7ed9e914ea..577b8970c9 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,7 +7,7 @@ mock==4.0.3
 psutil==5.9.4
 pycvesearch==1.2
 pydantic==1.10.7
-pytest==7.2.1
+pytest==7.2.2
 PyYAML==5.4.1
 questionary==1.10.0
 requests==2.28.2