minor fix 2

detections/endpoint/suspicious_rundll32_rename.yml

@@ -65,7 +65,7 @@ tags:
   context:
   - Source: Endpoint
   - Stage: Initial Access, Execution, Defense Evasion
-  message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user
+  message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml

@@ -57,7 +57,7 @@ tags:
   context:
   - Source: Endpoint
   - Stage: Initial Access, Execution, Defense Evasion
-  message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user 
+  message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$
   observable:
   - name: dest
     type: Endpoint

detections/endpoint/unified_messaging_service_spawning_a_process.yml

@@ -64,7 +64,7 @@ tags:
   - Stage: Initial Access, Execution
   message: Possible CVE-2021-26857 exploitation on $dest$
   observable:
-  - name: $dest
+  - name: dest
     type: Endpoint
     role:
     - Victim