From cff1c5dd7493fa0787751d2921d68dfd57cb9c8a Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 4 Jan 2022 08:23:36 -0800
Subject: [PATCH] Update Text of Detection

Minor update to text of "Possible Browser Pass View Parameter"
---
 .../endpoint/possible_browser_pass_view_parameter.yml  | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml
index 10f3a9bbb5..86c5a204c8 100644
--- a/detections/endpoint/possible_browser_pass_view_parameter.yml
+++ b/detections/endpoint/possible_browser_pass_view_parameter.yml
@@ -6,13 +6,13 @@ author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytic will detect a suspicious process contains a commandline
-  parameter related to web browser credential dumper. This technique is used by Remcos RAT 
-  malware where it uses the Nirsoft webbrowserpassview.exe application to dump web browser 
-  credentials. Remcos use the "/stext" command line to dump the credential in text format. 
+description: This analytic will detect if a suspicious process contains a commandline
+  parameter related to a web browser credential dumper. This technique is used by Remcos RAT 
+  malware which uses the Nirsoft webbrowserpassview.exe application to dump web browser 
+  credentials. Remcos uses the "/stext" command line to dump the credentials in text format. 
   This Hunting query is a good indicator of hosts suffering from possible Remcos RAT infection. 
   Since the hunting query is based on the parameter command and the possible path where it will 
-  save the text credential information, It may catch normal tools that are using the same command and behavior.
+  save the text credential information, it may catch normal tools that are using the same command and behavior.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process  IN ("*/stext
   *", "*/shtml *", "*/LoadPasswordsIE*", "*/LoadPasswordsFirefox*", "*/LoadPasswordsChrome*",