diff --git a/detections/endpoint/plink_remote_forwarding.yml b/detections/endpoint/plink_remote_forwarding.yml
index 9587b12b0f..dd59d62e49 100644
--- a/detections/endpoint/plink_remote_forwarding.yml
+++ b/detections/endpoint/plink_remote_forwarding.yml
@@ -1,18 +1,18 @@
 name: Plink Remote Forwarding
-id: 773e26e4-461a-11ec-a9be-acde48001122
+id: 547710a8-46fb-11ec-a3a1-acde48001122
 version: 1
-date: '2021-11-15'
+date: '2021-11-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination.
+description: 'The following analytic identifies the use of `plink` being utilized as a way to tunnel protocols outbound. Adversaries utilize this application to reverse proxy ssh and RDP outbound to a remote destination.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=plink.exe OR Processes.original_file_name="plink") Processes.process IN ("*-D *", "*-L *", "*-R *") OR Processes.process IN ("*-l *","*-pw *") OR Processes.process IN ("*-ssh*", "*-telnet*", "*-rlogin*" "*-raw*", "*-serial*") OR Processes.process IN ("*-T *","*-N *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
   Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+  | `security_content_ctime(lastTime)` 
   | `plink_remote_forwarding_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
 known_false_positives: False positives should be limited, however filter as needed.