diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml
index 85b90859fe..82aa79ab49 100644
--- a/detections/endpoint/suspicious_msbuild_rename.yml
+++ b/detections/endpoint/suspicious_msbuild_rename.yml
@@ -11,7 +11,7 @@ description: The following analytic identifies renamed instances of msbuild.exe
   C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify
   the code executed and what is executing a renamed instance of MSBuild.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=msbuild.exe AND Processes.process_name!=msbuild.exe)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.original_file_name=MSBuild.exe AND Processes.process_name!=msbuild.exe)
   by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name 
   | `drop_dm_object_name(Processes)`