diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
index 236274d15b..ab55d5ce1e 100644
--- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
+++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml
@@ -6,20 +6,22 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic looks for the execution of `sc.exe` with command-line
-  arguments utilized to create a Windows Service on a remote endpoint. Red Teams and 
-  adversaries alike may abuse the Service Control Manager for lateral movement and remote code execution.
+description: This analytic looks for the execution of `sc.exe` with command-line arguments
+  utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries
+  alike may abuse the Service Control Manager for lateral movement and remote code
+  execution.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe
   OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*create*
-  AND Processes.process=*binpath*) by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_creation_on_remote_endpoint_filter`'
+  AND Processes.process=*binpath*) by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `windows_service_creation_on_remote_endpoint_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
- logs with the process name, parent process, and command-line executions from your endpoints.
-known_false_positives: Administrators may create Windows Services on remote systems, but this
-  activity is usually limited to a small set of hosts or users.
+  logs with the process name, parent process, and command-line executions from your
+  endpoints.
+known_false_positives: Administrators may create Windows Services on remote systems,
+  but this activity is usually limited to a small set of hosts or users.
 references:
 - https://docs.microsoft.com/en-us/windows/win32/services/service-control-manager
 - https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc
@@ -64,4 +66,4 @@ tags:
     type: Endpoint
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed