diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 52d4a25641..8fb17415ed 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -24,7 +24,7 @@ search: '| from read_ssa_enriched_events()
   OR field0="java.exe" OR field0="powershell.exe"
 
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map([ "process_name", process_name, "parent_process",
+  dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
   parent_process]) | into write_ssa_detected_events();'
 how_to_implement: You must be ingesting sysmon logs. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
index deb0c58af0..ca13c9e39c 100644
--- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml
+++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
@@ -224,7 +224,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
 
   | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
-  union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" OR process_path
+  union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" AND process_path
   NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(device, user), body=create_map(["process_path", process_path,
   "process_name", process_name]) | into write_ssa_detected_events();'