diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml
index 79c945e82f..bc46e9cb8f 100644
--- a/detections/endpoint/powershell_execute_com_object.yml
+++ b/detections/endpoint/powershell_execute_com_object.yml
@@ -15,7 +15,7 @@ search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeF
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` 
-  | `execute_com_object_in_powershell_filter`'
+  | `powershell_execute_com_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the