diff --git a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
index e426fd3e8e..a37f167c8b 100644
--- a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
+++ b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
@@ -42,9 +42,6 @@ tags:
   - Suspicious Command-Line Executions
   asset_type: Endpoint
   confidence: 90
-  context:
-  - Source:Endpoint
-  - Stage:Execution
   impact: 50
   message: The process $process$ is running from an unusual place by $user$ on $dest$
     with a processname that appears to be randomly generated.
diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml
index 8ada9009b9..517d5e684c 100644
--- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml
+++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml
@@ -49,9 +49,6 @@ tags:
   - Active Directory Discovery
   asset_type: Endpoint
   confidence: 80
-  context:
-  - Source:Endpoint
-  - Stage:Privilege Escalation
   impact: 60
   message: Invoke-ShareFinder commandlet was executed on $Computer$
   mitre_attack_id:
diff --git a/detections/endpoint/windows_screen_capture_via_powershell.yml b/detections/endpoint/windows_screen_capture_via_powershell.yml
index 58297985b8..c2a4fd4fab 100644
--- a/detections/endpoint/windows_screen_capture_via_powershell.yml
+++ b/detections/endpoint/windows_screen_capture_via_powershell.yml
@@ -45,9 +45,6 @@ tags:
   - Winter Vivern
   asset_type: Endpoint
   confidence: 70
-  context:
-  - Source:Endpoint
-  - Stage:Collection
   impact: 70
   message: A PowerShell script was identified possibly performing screen captures
     on $Computer$.