Update windows_file_without_extension_in_critical_folder.yml

detections/endpoint/windows_file_without_extension_in_critical_folder.yml

@@ -29,7 +29,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Filesystem` node.
-known_false_positives: unknown
+known_false_positives: Unknown at this point
 references:
 -  https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html
 tags:
@@ -53,16 +53,20 @@ tags:
   - Filesystem.user 
   - Filesystem.file_path 
   - Filesystem.dest
+  - Processes.process_name 
+  - Processes.dest 
+  - Processes.process_guid
+  - Processes.user 
   security_domain: endpoint
   impact: 90
   confidence: 100 
   # (impact * confidence)/100
   risk_score: 90
   context: 
-  - source:endpoint
-  - stage:Persistence
+  - Source:Endpoint
+  - Stage:Persistence
   - Privilege Escalation
-  message: driver file with out file extension drop in $file_path$ in $dest$
+  message: Driver file with out file extension drop in $file_path$ in $dest$
   observable:
   - name: user
     type: User
@@ -73,4 +77,4 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16