From e1cb6fec1be73af0b9aa0a75369ddc4844df59da Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 19 May 2021 06:42:55 -0600
Subject: [PATCH] Update disable_windows_app_hotkeys.yml

---
 detections/endpoint/disable_windows_app_hotkeys.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml
index 28217e33bb..6596e0bf17 100644
--- a/detections/endpoint/disable_windows_app_hotkeys.yml
+++ b/detections/endpoint/disable_windows_app_hotkeys.yml
@@ -6,11 +6,11 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect a suspicious registry mdification to disable
-  windows hotkey (shortcut keys) for windows application. We've seen this techniques
-  used to disable certain or several windows application like taskmgr, cmd.exe and
-  etc. to impaire the user or analyst in analyzing and removing the attacker implant
-  in the vulnerable machine.
+description: This analytic detects a suspicious registry modification to disable
+  Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly
+  used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. 
+  This technique is used to impair the analyst in analyzing and removing the attacker implant
+  in compromised systems.
 search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
   as registry_key_name values(Registry.registry_path) as registry_path min(_time)
   as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\Windows
@@ -21,7 +21,7 @@ search: '| tstats `security_content_summariesonly` count values(Registry.registr
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
   in the registry node. This is typically populated via endpoint detection-and-response
-  product, such as Carbon Black or endpoint data sources, such as Sysmon. The data
+  product, such as CarbonBlack or endpoint data sources, such as Sysmon. The data
   used for this search is typically generated via logs that report reads and writes
   to the registry.
 known_false_positives: unknown