diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml
index 954a94377f..afc06b6f23 100644
--- a/detections/endpoint/wbemprox_com_object_execution.yml
+++ b/detections/endpoint/wbemprox_com_object_execution.yml
@@ -6,8 +6,11 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: this search is designed to detect potential malicious process loading
-  COM object to wbemprox.dll,
+description: The following analytic identifies a potential suspicious process loading a COM object from wbemprox.dll or faskprox.dll. 
+  The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software 
+  components that can interact. This feature is being abused by several threat actors, adversaries or even red teamers to gain privilege 
+  escalation or even to evade detections. This TTP is a good indicator that a process is loading possible known .dll modules that were known 
+  for its COM object. 
 search: '`sysmon` EventCode=7  ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll",
   "*\\wbemcomn.dll") NOT (process_name IN ("wmiprvse.exe", "WmiApSrv.exe", "unsecapp.exe"))
   NOT(Image IN("*\\windows\\*","*\\program files*", "*\\wbem\\*")) | stats count min(_time)