diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
index 3ccd474b43..85ecebbf31 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
@@ -30,7 +30,7 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: Powershell process having commandline $ScriptBlockText$ to query domain password policy on $dest$
+  message: Powershell process having commandline "Get-ADDefaultDomainPasswordPolicy" to query domain password policy on $dest$
   mitre_attack_id:
   - T1201
   observable: