minor fixes

detections/endpoint/start_up_during_safe_mode_boot.yml

@@ -51,4 +51,4 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Persistence
-  message: Safeboot registry $Registry.registry_path was added or modified with a new value $Registry.registry_value_name$
+  message: Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$

detections/endpoint/suspicious_msbuild_path.yml

@@ -65,7 +65,7 @@ tags:
   context:
   - Source: Endpoint
   - Stage: Initial Access, Execution, Defense Evasion
-  message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user 
+  message: Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml

@@ -66,7 +66,7 @@ tags:
   context:
   - Source: Endpoint
   - Stage: Initial Access, Execution, Defense Evasion
-  message: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user 
+  message: Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/unusually_long_command_line.yml

@@ -55,7 +55,7 @@ tags:
   context:
   - Source: Endpoint
   - Stage: Execution
-  message: Unusually long command line $Processes.process_name$ on $dest
+  message: Unusually long command line $Processes.process_name$ on $dest$
   observable:
   - name: dest
     type: Endpoint