diff --git a/detections/endpoint/ssa___windows_mshta_child_process.yml b/detections/endpoint/ssa___windows_mshta_child_process.yml
index 9706fd2350..bbad30871d 100644
--- a/detections/endpoint/ssa___windows_mshta_child_process.yml
+++ b/detections/endpoint/ssa___windows_mshta_child_process.yml
@@ -1,6 +1,6 @@
 name: Windows MSHTA Child Process
 id: f63f7e9c-9526-11ec-9fc7-acde48001122
-version: 1
+version: 2
 date: '2022-02-23'
 author: Michael Haag, Splunk
 type: TTP
@@ -14,13 +14,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
   "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
-  null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
-  null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
+  null), parent_process_name=lower(ucast(map_get(input_event, "parent_process_name"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
   cmd_line IS NOT NULL AND process_name IS NOT NULL AND parent_process_name IS NOT
-  NULL | where parent_process_name="mshta.exe" AND process_name="powershell.exe" OR
+  NULL | where like(parent_process_name, "%\\\\mshta.exe") AND (process_name="powershell.exe" OR
   process_name="cmd.exe" OR process_name="scrcons.exe" OR process_name="colorcpl.exe"
   OR process_name="msbuild.exe" OR process_name="microsoft.workflow.compiler.exe"
-  OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe"  OR process_name="wscript.exe"
+  OR process_name="searchprotocolhost.exe" OR process_name="cscript.exe"  OR process_name="wscript.exe")
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",