diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml
index d95c91a2ae..ad1a9c0022 100644
--- a/detections/endpoint/shim_database_file_creation.yml
+++ b/detections/endpoint/shim_database_file_creation.yml
@@ -50,9 +50,9 @@ tags:
   - Filesystem.dest
   security_domain: endpoint
   impact: 70 
-  confidence: 85  
+  confidence: 80  
   # (impact * confidence)/100
-  risk_score: 59.5 
+  risk_score: 56 
   context:
   - source:endpoint
   - stage: Privilege Escalation