diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
index b263162b6b..04dbeae255 100644
--- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
+++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
@@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events()
 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), body=create_map(["dest_user_id", dest_user_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+  "string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting Windows Security logs from devices of interest,
   including the event ID 4688 with enabled command line logging.
 known_false_positives: None identified.