From f73d76057160908f44b0dcdf659cb5ff95de3f5e Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 21 Feb 2023 09:07:23 -0700
Subject: [PATCH] Update
 windows_steal_authentication_certificates_cryptoapi.yml

---
 .../windows_steal_authentication_certificates_cryptoapi.yml   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
index 490f523376..3c84577673 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
@@ -6,7 +6,7 @@ author: Michael Haag, Splunk
 type: Anomaly
 datamodel: []
 description: The following analytic utilizes a Windows Event Log - CAPI2 - or CryptoAPI 2, to identify suspicious certificate extraction. Typically, this event log is meant for diagnosing PKI issues, however is a great source to identify certificate exports. 
-  Note that this event log is noisy as it captures common PKI requests from many different processes. EventID 70 is generated anytime a certificate is exported. The description for EventID 70 is "Acquire Certifcate Private Key".
+  Note that this event log is noisy as it captures common PKI requests from many different processes. EventID 70 is generated anytime a certificate is exported. The description for EventID 70 is "Acquire Certificate Private Key".
   STRT tested this analytic using Mimikatz binary and the implementation of Mimikatz in Cobalt Strike.
 search: '`capi2_operational` EventCode=70
   | xmlkv UserData_Xml
@@ -51,4 +51,4 @@ tags:
   - Computer
   - UserData_Xml
   risk_score: 24
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint