diff --git a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
index b73a9ab403..ac651d79f7 100644
--- a/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
+++ b/detections/endpoint/macos_amos_stealer___virtual_machine_check_activity.yml
@@ -11,12 +11,8 @@ description: |
 data_source:
   - osquery
 search: |
-  '`osquery_macro` name=es_process_events 
-    columns.cmdline="*osascript*"
-    columns.cmdline="* -e *"
-    columns.cmdline="*set*"
-    columns.cmdline="*system_profiler*"
-    columns.cmdline IN ("*VMware*", "*QEMU*") 
+  `osquery_macro` name=es_process_events 
+  columns.cmdline="*osascript*" AND columns.cmdline="* -e *" AND columns.cmdline="*set*" AND columns.cmdline="*system_profiler*" AND columns.cmdline IN ("*VMware*", "*QEMU*") 
   | rename columns.* as * 
   | stats  min(_time) as firstTime max(_time) as lastTime 
     values(cmdline) as cmdline, 
@@ -28,11 +24,12 @@ search: |
   | rename 
     username as user, 
     cmdline as process, 
+    parent as parent_process, 
     path as process_path, 
     host as dest 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
-  | `macos_amos_stealer___virtual_machine_check_activity_filter`'
+  | `macos_amos_stealer___virtual_machine_check_activity_filter`
 how_to_implement: |
   This detection leverages osquery and endpoint security on MacOS. Follow the link in references, which describes how to setup process auditing in MacOS with endpoint security and osquery.
 known_false_positives: None identified.