diff --git a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
index c19d80db46..ebe5569c97 100644
--- a/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
+++ b/detections/endpoint/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
@@ -95,7 +95,7 @@ tags:
   - process_path
   - dest_user_id
   - process
-  - cmd_line
+  - process
   risk_score: 35
   risk_severity: low
   security_domain: endpoint