diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
similarity index 95%
rename from detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
rename to detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
index cf5049d951..3126b2a12b 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
@@ -1,4 +1,4 @@
-name: Get ADUserResultantPasswordPolicy with Powershell 
+name: Get ADUserResultantPasswordPolicy with Powershell
 id: 8b5ef342-065a-11ec-b0fc-acde48001122
 version: 1
 date: '2021-08-26'
@@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   Processes.parent_process_name | `drop_dm_object_name(Processes)` 
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`
-  | `get_aduserresultantpasswordpolicy_with_powershell__filter`'
+  | `get_aduserresultantpasswordpolicy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the