diff --git a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
index 244afa2e5d..4d42ecf8c3 100644
--- a/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
+++ b/detections/endpoint/ssa___windows_certutil_urlcache_download.yml
@@ -5,7 +5,7 @@ date: '2022-02-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
-- Endpoint
+- Endpoint_Processes
 description: Certutil.exe may download a file from a remote destination using `-urlcache`.
   This behavior does require a URL to be passed on the command-line. In addition,
   `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will