diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
index 76b8e82de4..69de70011c 100644
--- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
+++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml
@@ -1,7 +1,7 @@
 name: Suspicious Image Creation In Appdata Folder
 id: f6f904c4-1ac0-11ec-806b-acde48001122
-version: 1
-date: '2021-09-21'
+version: 2
+date: '2022-07-07'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -14,14 +14,17 @@ description: This search is to detect a suspicious creation of image in appdata
   not commonly created by user in this folder path.
 search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
   where Processes.process_name=*.exe Processes.process_path="*\\appdata\\Roaming\\*"
-  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
-  | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
+  by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid
+  | `drop_dm_object_name(Processes)` 
+  |rename process_guid as proc_guid 
+  |join proc_guid, _time [| tstats `security_content_summariesonly`
   count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path
-  = "*\\appdata\\Roaming\\*" by _time span=1h Filesystem.dest Filesystem.file_create_time
-  Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` |
-  fields _time dest file_create_time file_name file_path process_name process_path
-  process] | `suspicious_image_creation_in_appdata_folder_filter`'
+  where Filesystem.file_name IN ("*.png","*.jpg","*.bmp","*.gif","*.tiff") Filesystem.file_path= "*\\appdata\\Roaming\\*" 
+  by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid 
+  | `drop_dm_object_name(Filesystem)` 
+  |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path
+  process proc_guid]
+  | `suspicious_image_creation_in_appdata_folder_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the