diff --git a/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml b/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
index 910f541343..96ce48f223 100644
--- a/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_defender_tools_in_non_standard_path.yml
@@ -10,11 +10,11 @@ description: The following analytic identifies usage of the MPCmdRun utility tha
 search: ' from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
   "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
   "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string", 
+  null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
   null)), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name IS NOT NULL AND process_name="mpcmdrun.exe" | where process_path IS NOT NULL AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false AND match_regex(process_path, /(?i)\\windows defender/)=false | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
-  event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events(); '
+  event_id, "process_path", process_path, "process_name", process_name, "cmd_line", cmd_line]) | into write_ssa_detected_events(); '
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: False positives may be present and filtering may be required.
 references:
diff --git a/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
index 58e9d7a3ed..0a273e259c 100644
--- a/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
+++ b/tests/endpoint/ssa___windows_defender_tools_in_non_standard_path.test.yml
@@ -8,6 +8,6 @@ tests:
   attack_data:
   - file_name: UPDATE
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/mpcmdrun/windows-security.log
-    source: XmlWinEventLog:Security
+    source: XmlWinEventLog
     sourcetype: XmlWinEventLog
     update_timestamp: true