diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml
index 61b6926470..b185e92dbd 100644
--- a/detections/endpoint/windows_event_log_cleared.yml
+++ b/detections/endpoint/windows_event_log_cleared.yml
@@ -11,9 +11,9 @@ description: The following analytic utilizes Windows Security Event ID 1102 or S
   triage, based on time of day and user, determine if this was planned. If not planned,
   follow through with reviewing parallel alerts and other data sources to determine
   what else may have occurred.
-search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
+search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104)
   | stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`'
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
 known_false_positives: It is possible that these logs may be legitimately cleared