diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
index 47b2c98444..36d75e0a20 100644
--- a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
+++ b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
@@ -6,7 +6,9 @@ author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
 data_source:
-- Sysmon EventID 12, 13, 14
+- Sysmon EventID 12
+- Sysmon EventID 13
+- Sysmon EventID 14
 description: The following analytic identifies a suspicious registry modification of Windows auto update configuration. 
   This technique was being abused by several adversaries, malware authors and also red-teamers to bypass detection or 
   to be able to compromise the target host with zero day exploit or as an additional defense evasion technique.
@@ -63,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/modify_registry/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog