From bb87cc35dbd82f0164c777a1ce71731326db920c Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 27 Oct 2022 10:52:56 +0200
Subject: [PATCH 1/2] Update windows_wmi_impersonate_token.yml

---
 detections/endpoint/windows_wmi_impersonate_token.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml
index 2a2e91e985..19a649a898 100644
--- a/detections/endpoint/windows_wmi_impersonate_token.yml
+++ b/detections/endpoint/windows_wmi_impersonate_token.yml
@@ -38,7 +38,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log
   impact: 50
   kill_chain_phases:
   - Exploitation

From c7aa9ecefaa549ca39c9efb128c5c4f661aa7a29 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 27 Oct 2022 10:55:27 +0200
Subject: [PATCH 2/2] Update
 windows_modify_registry_qakbot_binary_data_registry.yml

---
 .../windows_modify_registry_qakbot_binary_data_registry.yml     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
index d8cff58983..73df4e02a1 100644
--- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
+++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies a suspicious registry entry created by Qakbot malware as part of malicious execution. 
+description: The following analytic identifies a suspicious registry entry created by Qakbot malware as part of its malicious execution. 
   This "Binary Data" Registry  was created by newly spawn explorer.exe where its malicious code is injected to it. The registry consist of 8 random registry value name 
   with encrypted binary data on its registry value data. This anomaly detections can be a good pivot for possible Qakbot malware infection or other malware that uses registry 
   to save or store there config or malicious code on the registry data stream.