From bcdfb2bbdecfbc6d9cac7fb2f5ea6f305a4a9cd5 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 15 Feb 2023 11:23:47 +0100
Subject: [PATCH] Update linux_impair_defenses_process_kill.yml

---
 detections/endpoint/linux_impair_defenses_process_kill.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/linux_impair_defenses_process_kill.yml b/detections/endpoint/linux_impair_defenses_process_kill.yml
index c331b39646..b847575427 100644
--- a/detections/endpoint/linux_impair_defenses_process_kill.yml
+++ b/detections/endpoint/linux_impair_defenses_process_kill.yml
@@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for pkill process execution for possible termination of process. 
-  This technique is being used by several Threat actors, adversaries and red team to terminate process in a targeted linux machine. 
+description: This analytic looks for PKILL process execution for possible termination of process. 
+  This technique is being used by several Threat actors, adversaries and red teamers to terminate processes in a targeted linux machine. 
   This anomaly detection can be a good pivot to check a possible defense evasion technique or termination of security application in a linux host or 
   wiper like Awfulshred that corrupt all files.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes