diff --git a/detections/endpoint/windows_dns_gather_network_info.yml b/detections/endpoint/windows_dns_gather_network_info.yml
index f38bef970f..2f3c04199c 100644
--- a/detections/endpoint/windows_dns_gather_network_info.yml
+++ b/detections/endpoint/windows_dns_gather_network_info.yml
@@ -6,11 +6,7 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies a process commandline to enumerate DNS records. 
-  Adversaries, threat actor or red teamer may use this to gather information about the victim's DNS that can be used during targeting. 
-  This technique was also seen in as part of tool used by sandworm APT group in a geo-potical cyber warfare attack.By using dnscmd.exe Windows application 
-  attacker can enumerate dns record of specific domain of targeted network to be used in further attacks. This Anomaly detection can be a good pivot to look for 
-  users and hostname that might be compromised or targeted by an adversaries to collect data information.
+description: The following analytic identifies a process command line used to enumerate DNS records. Adversaries, threat actors, or red teamers may employ this technique to gather information about a victim's DNS, which can be utilized during targeting. This method was also observed as part of a tool used by the Sandworm APT group in a geopolitical cyber warfare attack. By using the dnscmd.exe Windows application, an attacker can enumerate DNS records for specific domains within the targeted network, potentially aiding in further attacks. This anomaly detection can serve as a valuable starting point for identifying users and hostnames that may be compromised or targeted by adversaries seeking to collect data information.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
   where Processes.process_name = "dnscmd.exe" Processes.process = "* /enumrecords *"
   by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest