From 8a95bfd0b8ebe69e2e55c9d4e5b84f2a9653d242 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 5 Jul 2022 15:37:46 +0200
Subject: [PATCH] Update windows_remote_services_allow_remote_assistance.yml

---
 .../windows_remote_services_allow_remote_assistance.yml         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml
index 36e10cc707..890a3cd01c 100644
--- a/detections/endpoint/windows_remote_services_allow_remote_assistance.yml
+++ b/detections/endpoint/windows_remote_services_allow_remote_assistance.yml
@@ -7,7 +7,7 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: The following analytic is to identify a modification in the Windows registry
-  to enable remoted desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
+  to enable remote desktop assitance on a targeted machine. This technique was seen in several adversaries, malware or red teamer 
   like azorult to remotely access the compromised or targeted host by enabling this protocol in registry. Even this protocol might be allowed in some 
   production environment, This Anomaly behavior is a good pivot to check who and why the user want to enable this feature through registry which is un-common.
   And as per stated in microsoft documentation the default value of this registry is false that makes this a good indicator of suspicious behavior.