Cleaned up signature descriptions and metadata.

queries/windows/process_injection.yml

@@ -1,17 +1,18 @@
 title: T1055 Process Injection
 description: Detects Process Injection through execution of MavInject, filtering out
   noisy/expected activity. SrcProcParentName filter narrows Cross Process items to
-  HQ results.
+  refine results.
 author: keyboardcrunch
 date: 10/10/2020
-modified: null
+modified: 05/12/2020
 mitre:
    tactic: Defense Evasion, Privilege Escalation
    technique: T1055
-   subtechnique: null
+   subtechnique: 
 operating_system: windows
 query: (TgtProcName = "mavinject.exe" AND TgtProcCmdLine ContainsCIS "/injectrunning")
   AND (SrcProcName Not In ("AppVClient.exe") AND SrcProcParentName Not In ("smss.exe"))
-false_positives: null
-tags: null
+false_positives: 
+   - Legitimate usage of MavInject
+tags: