diff --git a/detections/create_local_admin_via_net.yml b/detections/create_local_admin_via_net.yml
index 6cc228236c..624c8466c1 100644
--- a/detections/create_local_admin_via_net.yml
+++ b/detections/create_local_admin_via_net.yml
@@ -35,12 +35,11 @@ detect:
         latest_time: -10m@m
       search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process)
         as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-        where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by
+        where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by
         Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)`
-        | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`  | search (process=*localgroup* OR
-        process=*/add* OR process=*user*) |`create_local_admin_via_net_filter`'
+        | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_via_net_filter`'
       suppress:
-        suppress_fields: dest
+        suppress_fields: dest, process_name
         suppress_period: 86400s
 eli5: Net.exe is a built-in Windows command-line tool that can be used to add, display,
   or modify user accounts. While Microsoft administrators use this tool to manage