diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
index b511d1c3d2..db2127f2b5 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
@@ -12,9 +12,9 @@ description: This detection identifies potential Pass the Token or Pass the Hash
   by a detination device.
 search: '| from read_ssa_enriched_events() | eval timestamp=      parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
-  "string", null)), dest_user_id=   lower(ucast(map_get(input_event, "dest_user_id"),
-  "string", null)), dest_device_id=       lower(ucast(map_get(input_event, "dest_device_id"),
-  "string", null)), signature_id=   lower(ucast(map_get(input_event, "signature_id"),
+  "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"),
+  "string", null), dest_device_id=       ucast(map_get(input_event, "dest_device_id"),
+  "string", null), signature_id=   lower(ucast(map_get(input_event, "signature_id"),
   "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
   "string", null))
 
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
index 38a83a7c3a..06caeb30d0 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
@@ -13,9 +13,9 @@ description: This detection identifies potential Pass the Token or Pass the Hash
   destination).
 search: '| from read_ssa_enriched_events() | eval timestamp=      parse_long(ucast(map_get(input_event,
   "_time"), "string", null)), dest_user=      lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
-  "string", null)), dest_user_id=   lower(ucast(map_get(input_event, "dest_user_id"),
-  "string", null)), origin_device_id=       lower(ucast(map_get(input_event, "origin_device_id"),
-  "string", null)), signature_id=   lower(ucast(map_get(input_event, "signature_id"),
+  "string", null)), dest_user_id=   ucast(map_get(input_event, "dest_user_id"),
+  "string", null), origin_device_id=       ucast(map_get(input_event, "origin_device_id"),
+  "string", null), signature_id=   lower(ucast(map_get(input_event, "signature_id"),
   "string", null)), authentication_method=  lower(ucast(map_get(input_event, "authentication_method"),
   "string", null))