diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml
index a4b9aec923..13b8e3f333 100644
--- a/detections/endpoint/excessive_attempt_to_disable_services.yml
+++ b/detections/endpoint/excessive_attempt_to_disable_services.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect suspicious series of commandline to disable
-  several services. This technique is seen in some adversaries and attacker to disable
-  security app services or other malware services to own the vulnerable machine.
+description: This analytic will identify suspicious series of command-line to disable
+  several services. This technique is seen where the adversary attempts to disable
+  security app services or other malware services to complete the objective on the compromised system.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name =