diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index e010469c87..8fbfb125bb 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -2,10 +2,10 @@ name: Suspicious msbuild rename
 id: 4006adac-5937-11eb-ae93-0242ac130002
 version: 1
 date: '2021-01-12'
-description: The following analytic identifies renamed instances of msbuild.exe executing. 
-  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and 
-  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify the
-  code executed and what is executing a renamed instance of MSBuild.
+description: The following analytic identifies renamed instances of msbuild.exe executing.
+  Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and
+  C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
+  the code executed and what is executing a renamed instance of MSBuild.
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -17,14 +17,15 @@ references:
 - https://github.com/infosecn1nja/MaliciousMacroMSBuild/
 author: Michael Haag, Splunk
 search: '`sysmon` EventID=1 (OriginalFileName=msbuild.exe OR process_name=msbuild.exe)
-| stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine
-| rename Computer as dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)`| `suspicious_msbuild_rename_filter`'
+  | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User,
+  parent_process_name, process_name, OriginalFileName, process_path, CommandLine |
+  rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`|
+  `suspicious_msbuild_rename_filter`'
 known_false_positives: Although unlikely, some legitimate applications may use a moved
- copy of msbuild, triggering a false positive.
+  copy of msbuild, triggering a false positive.
 tags:
   analytics_story:
-  - 'Trusted developer utilities proxy execution msbuild'
+  - Trusted developer utilities proxy execution msbuild
   mitre_attack_id:
   - T1127.001, T1036.003
   kill_chain_phases:
@@ -38,3 +39,4 @@ tags:
   asset_type: Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  automated_detection_testing: passed