diff --git a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
index cd14955bb3..73a3393133 100644
--- a/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
+++ b/detections/endpoint/windows_indirect_command_execution_via_forfiles.yml
@@ -1,5 +1,5 @@
 name: Windows Indirect Command Execution Via forfiles
-id: 59e54602-9680-11ec-a8a6-aaaaaaaaaaaa
+id: 1fdf31c9-ff4d-4c48-b799-0e8666e08787
 version: 1
 date: '2022-04-05'
 author: Eric McGinnis, Splunk