diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
index d334b82b64..050f660cab 100644
--- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml
@@ -51,10 +51,11 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: Mmc.exe spawned a LOLBAS process on $dest
+  message: Mmc.exe spawned a LOLBAS process on $dest$.
   mitre_attack_id:
   - T1021
   - T1021.003
+  - T1218.014
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
index 94fd63e776..72034d4e6b 100644
--- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
+++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml
@@ -59,6 +59,7 @@ tags:
   - T1053.005
   - T1543.003
   - T1059.001
+  - T1218.014
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
index 4faeaf4a87..7fac70b705 100644
--- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
+++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml
@@ -42,6 +42,7 @@ tags:
   mitre_attack_id:
   - T1548.002
   - T1548
+  - T1218.014
   observable:
   - name: Computer
     type: Hostname