diff --git a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
index 61e05f0745..357e069ef9 100644
--- a/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
+++ b/detections/endpoint/detect_remote_access_software_usage_fileinfo.yml
@@ -27,7 +27,7 @@ how_to_implement: This analytic relies on Sysmon to be properly installed and ut
   lookup, as well as a KVStore collection named "remote_software_exceptions" 
   that lets you track and maintain device-based exceptions for this set of detections.
 known_false_positives: Known or approved applications used by the organization or
-  usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception.csv 
+  usage of built-in functions. Known false positives can be added to the remote_access_software_usage_exception 
   lookup to globally suppress these situations across all remote access content
 references:
 - https://attack.mitre.org/techniques/T1219/