Merge pull request #4189 from splunk/smallfix

Minor fixes

Author: pyth0n1c

detections/endpoint/common_ransomware_extensions.yml

@@ -45,7 +45,7 @@ search: |
         "*.txt", "*.url", "*.vb", "*.vbe", "*.vbs", "*.vcxproj", "*.vhd", "*.vhdx",
         "*.wav", "*.webm", "*.webp", "*.wim", "*.wsf", "*.xlam", "*.xls", "*.xlsb",
         "*.xlsm", "*.xlsx", "*.xlt", "*.xltm", "*.xltx", "*.xml", "*.xps",
-        "*.yaml", "*.yml", "*.zip"
+        "*.yaml", "*.yml"
     )
     BY Filesystem.action Filesystem.dest
         Filesystem.file_access_time Filesystem.file_create_time

detections/endpoint/windows_file_without_extension_in_critical_folder.yml

@@ -7,7 +7,7 @@ author: Teoderick Contreras, Bhavin Patel, Splunk
 status: production
 type: Anomaly
 description: |-
-    This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, Windows\WinSxS, and other known Windows driver storage and loading paths.
+    This analytic detects the creation of files without extensions in critical Windows system and driver-related directories, including but not limited to System32\Drivers, and other known Windows driver storage and loading paths.
     The analytic leverages telemetry from the Endpoint.Filesystem data model, with a focus on file creation events and file path analysis.
     File creation activity in these directories—particularly involving extensionless files—is highly suspicious, as it may indicate the presence of destructive or stealthy malware.
     This behavior is consistent with malware families such as HermeticWiper, which deploy kernel driver components into trusted Windows driver directories to obtain low-level access and execute destructive payloads.