diff --git a/detections/endpoint/windows_network_share_discovery_with_net.yml b/detections/endpoint/windows_network_share_discovery_with_net.yml
index b979ba567d..51631b61f6 100644
--- a/detections/endpoint/windows_network_share_discovery_with_net.yml
+++ b/detections/endpoint/windows_network_share_discovery_with_net.yml
@@ -8,7 +8,7 @@ type: TTP
 data_source:
 - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log
 description: Network share discovery performed on Windows or MacOS. 
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe" OR Processes.orig_process_name="net.ex  e") AND (Processes.process="*net*view*" OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit  FROM datamodel=Endpoint.Processes WHERE ((Processes.process_name="net.exe" OR Processes.orig_process_name="net.exe") AND (Processes.process="*net*view*" OR Processes.process="*net*share*")) BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec
   Processes.process Processes.parent_process
   | `drop_dm_object_name(Processes)`
   | regex process="net\s+view|net\s+share"