Update disable_windows_app_hotkeys.yml

detections/endpoint/disable_windows_app_hotkeys.yml

@@ -6,11 +6,11 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious registry mdification to disable
-  windows hotkey (shortcut keys) for windows application. We've seen this techniques
-  used to disable certain or several windows application like taskmgr, cmd.exe and
-  etc. to impaire the user or analyst in analyzing and removing the attacker implant
-  in the vulnerable machine.
+description: This analytic detects a suspicious registry modification to disable
+  Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly
+  used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. 
+  This technique is used to impair the analyst in analyzing and removing the attacker implant
+  in compromised systems.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
   used for this search is typically generated via logs that report reads and writes
   to the registry.
 known_false_positives: unknown