diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 0e2ca3b843..fbf87bc0fe 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -45,8 +45,8 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains base64 command in $Message$ with
-    EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with
+    EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059
   - T1027