Update cmd_carry_out_string_command_parameter.yml

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -2,7 +2,7 @@ name: CMD Carry Out String Command Parameter
 id: 54a6ed00-3256-11ec-b031-acde48001122
 version: 2
 date: '2021-12-13'
-author: Teoderick Contreras, Splunk, Bhavin Patel, Splunk
+author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Hunting
 datamodel:
 - Endpoint
@@ -18,10 +18,11 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `cmd_carry_out_string_command_parameter_filter`'
-how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the process name, parent process, and command-line executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives may be high based on legitimate scripted code in any environment.
   Filter as needed.
 references:
@@ -69,4 +70,4 @@ tags:
   - Processes.process_id
   - Processes.parent_process_id
   risk_score: 30
-  security_domain: endpoint
+  security_domain: endpoint