diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml
index f0121fc557..6b22476513 100644
--- a/detections/endpoint/windows_dll_side_loading_in_calc.yml
+++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml
@@ -35,7 +35,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: a dll modules is loaded in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$
+  message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$
   mitre_attack_id:
   - T1574.002
   - T1574