diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml
index f1191ab224..2cbc3e5720 100644
--- a/detections/endpoint/system_information_discovery_detection.yml
+++ b/detections/endpoint/system_information_discovery_detection.yml
@@ -1,7 +1,7 @@
 name: System Information Discovery Detection
 id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
-version: 1
-date: '2020-10-12'
+version: 2
+date: '2021-09-07'
 author: Patrick Bareiss, Splunk
 type: TTP
 datamodel:
@@ -9,13 +9,18 @@ datamodel:
 description: Detect system information discovery techniques used by attackers to understand
   configurations of the system to further exploit it.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
-  OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
-  Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
-  | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
-  > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
-  by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `system_information_discovery_detection_filter`'
+    as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
+    OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
+    Processes.process_name Processes.process Processes.dest Processes.parent_process_name 
+| `drop_dm_object_name(Processes)` 
+| eventstats dc(process) as dc_processes_by_dest by dest 
+| where dc_processes_by_dest
+    > 2 
+| stats values(process) as processes min(firstTime) as firstTime max(lastTime) as lastTime
+    by user, dest parent_process_name
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `system_information_discovery_detection_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.