diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
index 100ae8d21c..d933a94bea 100644
--- a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -11,12 +11,13 @@ how_to_implement: You must be ingesting endpoint data that tracks process activi
 type: ESCU
 references: []
 author: Patrick Bareiss, Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe
-  OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
-  OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*)
-  by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` '
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
+  from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe OR Processes.process_name=cmd.exe)
+  Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM*
+  OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System*
+  OR Processes.process=*HKLM\\SAM*) by Processes.user Processes.process_name Processes.process Processes.dest
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `attempted_credential_dump_from_registry_via_reg_exe_filter`'
 known_false_positives: None identified.
 tags:
   analytics_story: