From cebc5ac4fd1aba5873eed1aad608c41a72f5feca Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 5 Jan 2022 16:38:48 +0100
Subject: [PATCH] Update linux_edit_cron_table_parameter.yml

---
 detections/endpoint/linux_edit_cron_table_parameter.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml
index b20897b8aa..a2e4695ee0 100644
--- a/detections/endpoint/linux_edit_cron_table_parameter.yml
+++ b/detections/endpoint/linux_edit_cron_table_parameter.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: The following analytic identifies a suspicious edit cronjobs parameter.
+description: The following analytic identifies a suspicious cronjobs modification using crontab edit parameter.
   This commandline parameter can be abuse by malware author, adversaries, and red
   red teamers to add cronjob entry to their malicious code to execute to the schedule
   they want. This event can also be executed by administrator or normal user for automation