From fb5dc80bebe84aaeeab382aecf95ef7c52c4d0f9 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 19 May 2021 06:55:09 -0600
Subject: [PATCH] Update excessive_attempt_to_disable_services.yml

---
 .../endpoint/excessive_attempt_to_disable_services.yml      | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml
index a4b9aec923..13b8e3f333 100644
--- a/detections/endpoint/excessive_attempt_to_disable_services.yml
+++ b/detections/endpoint/excessive_attempt_to_disable_services.yml
@@ -6,9 +6,9 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect suspicious series of commandline to disable
-  several services. This technique is seen in some adversaries and attacker to disable
-  security app services or other malware services to own the vulnerable machine.
+description: This analytic will identify suspicious series of command-line to disable
+  several services. This technique is seen where the adversary attempts to disable
+  security app services or other malware services to complete the objective on the compromised system.
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   values(Processes.process_id) as process_id count min(_time) as firstTime max(_time)
   as lastTime  from datamodel=Endpoint.Processes where   Processes.process_name =