Update rules/integrations/endpoint/defense_evasion_elastic_memory_thr…

…eat_detected.toml

Co-authored-by: Terrance DeJesus <[email protected]>

rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml

@@ -38,7 +38,7 @@ The second category is referred to as shellcode thread and is unique to Windows
 - Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
 - Assess whether this behavior is prevalent in the environment by looking for similar occurrences across hosts :
    - For shellcode alerts, the key for bucketing alerts is stored in the `Memory_protection.unique_key_v1` field.
-   - For Memory signature alerts are bucketed based on the signatures which hit `rule.name`.
+   - For Memory signature alerts, bucket based on the signatures which match `rule.name`.
 - Examine the following fields if there are any matches on known Yara signatures:
   - `process.Ext.memory_region.malware_signature.all_names`
   - `Target.process.Ext.memory_region.malware_signature.all_names`