diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
index a7f5a010da..86f9ebd78a 100644
--- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
+++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
@@ -13,7 +13,7 @@ description: 'The following query utilizes Windows Security EventCode 4698, `A s
 
   The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory.\
   
-  Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
+  Upon triage, identify the task scheduled source. Was it schtasks.exe or was it via TaskService. Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.'
 search: '`wineventlog_security` EventCode=4698
   | xmlkv Message 
   | search Command IN ("*\\users\\public\\*", "*\\programdata\\*", "*\\temp\\*", "*\\Windows\\Tasks\\*", "*\\appdata\\*")
@@ -26,7 +26,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: False positives are possible if legitimate applications are allowed to register tasks in public paths. Filter as needed based on paths that are used legitimately. 
 references:
   - https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
+  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4698
   - https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
+  - https://docs.microsoft.com/en-us/windows/win32/taskschd/time-trigger-example--scripting-?redirectedfrom=MSDN
+tags:
   analytic_story:
   - Windows Persistence Techniques
   - Ransomware