fixes to yaml

detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml

@@ -5,14 +5,9 @@ date: '2022-05-26'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: This analytic looks for suspicious commandline that may use to append
-  user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by
-  malware, adversaries or red teamers to persist on the targeted or compromised host.
-  These config file can restrict user that can only execute at application (another
-  schedule task application in linux). attacker can create a user or add the compromised
-  username to that config file to execute at to schedule it malicious code. This anomaly
-  detection can be a good indicator to investigate further the entry in created config
-  file and who created it to verify if it is a false positive.
+description: The following analytic is designed to identify suspicious command lines that may append user entries to either /etc/at.allow or /etc/at.deny. These files can be exploited by malicious actors for persistence on a compromised Linux host by altering permissions for scheduled tasks using the at command.\
+
+  In this context, an attacker can create a user or add an existing user to these configuration files to execute their malicious code through scheduled tasks. The detection of such anomalous behavior can serve as an effective indicator warranting further investigation to validate if the activity is indeed malicious or a false positive.
 data_source:
 - Sysmon Event ID 1
 search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes

dev/endpoint/linux_possible_append_command_to_at_allow_config_file.yml

@@ -1,11 +1,11 @@
-name: Linux Possible Append Command To At Allow Config File
+name: Linux Possible Append Command To At Allow Config Filedasdasdasdasdasdasdasdasdasdasdasdaadsadasdasdasdasd
 id: 7bc20606-5f40-11ec-a586-acde48001122
 version: 2
 date: '2022-05-26'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
-description: The following analytic is designed to identify suspicious command lines that may append user entries to either /etc/at.allow or /etc/at.deny. These files can be exploited by malicious actors for persistence on a compromised Linux host by altering permissions for scheduled tasks using the at command.
+description: The following analytic is designed to identify suspicious command lines that may append user entries to either /etc/at.allow or /etc/at.deny. These files can be exploited by malicious actors for persistence on a compromised Linux host by altering permissions for scheduled tasks using the at command.\
 
   In this context, an attacker can create a user or add an existing user to these configuration files to execute their malicious code through scheduled tasks. The detection of such anomalous behavior can serve as an effective indicator warranting further investigation to validate if the activity is indeed malicious or a false positive.
 data_source: