diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml
index de697abeb1..37e7ac8c83 100644
--- a/detections/endpoint/office_application_spawn_rundll32_process.yml
+++ b/detections/endpoint/office_application_spawn_rundll32_process.yml
@@ -51,7 +51,7 @@ tags:
   security_domain: endpoint
   impact: 70
   confidence: 90
-  risk_score: 50
+  risk_score: 63
   context:
   - Source:Endpoint
   - Stage:Execution