diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index 945b508755..597d36ea1f 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -7,18 +7,19 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of PowerShell with arguments utilized to start a process on a remote endpoint 
-  by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet.
-  Red Teams and adversaries alike may abuse WinRM for lateral movement and remote code execution.
+  to identify the execution of PowerShell with arguments utilized to start a process
+  on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks
+  for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike
+  may abuse WinRM for lateral movement and remote code execution.
 search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start a process
-  on remote systems for system administration or automation use cases. However, this activity is usually limited to a small set of hosts
-  or users.
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start
+  a process on remote systems for system administration or automation use cases. However,
+  this activity is usually limited to a small set of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1021/006/
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
@@ -49,10 +50,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing WinRM using PowerShell.exe
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WinRM using PowerShell.exe
   observable:
   - name: ComputerName
     type: Endpoint
     role:
     - Victim
-  
\ No newline at end of file
+  automated_detection_testing: passed