diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index 389646d37e..e2ae759d0c 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -52,9 +52,9 @@ tags:
   - Stage:Privilege Escalation
   - Stage:Defense Evasion
   - Scope:Incoming
-  message: Suspicious modification of registry $Registry.registry_path$ with possible payload path $Registry.registry_value_name$ in $Registry.dest$
+  message: Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$
   observable:
-  - name: Registry.dest
+  - name: dest
     type: Hostname
     role:
     - Victim