diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml
index a5b5b822a9..8f9e8b0ec7 100644
--- a/detections/endpoint/msmpeng_application_dll_side_loading.yml
+++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml
@@ -1,8 +1,8 @@
 name: Msmpeng Application DLL Side Loading
 id: 8bb3f280-dd9b-11eb-84d5-acde48001122
-version: 1
+version: 2
 date: '2021-07-05'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Splunk, Sanjay Govind
 type: TTP
 datamodel:
 - Endpoint
@@ -15,7 +15,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a
   file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem
   where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll")  AND
   Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time
-  Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)`
+  Filesystem.process_id  Filesystem.file_name Filesystem.user | `drop_dm_object_name(Filesystem)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from
diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
index 99f25fd29a..ab6949542f 100644
--- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
+++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml
@@ -1,8 +1,8 @@
 name: Remcos RAT File Creation in Remcos Folder
 id: 25ae862a-1ac3-11ec-94a1-acde48001122
-version: 1
+version: 2
 date: '2021-09-21'
-author: Teoderick Contreras, Splunk
+author: Teoderick Contreras, Splunk, Sanjay Govind
 type: TTP
 datamodel:
 - Endpoint
@@ -13,7 +13,7 @@ description: This search is to detect file creation in remcos folder in appdata
 search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dat")
   Filesystem.file_path = "*\\remcos\\*" by _time Filesystem.file_name Filesystem.file_path
-  Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Processes)` |
+  Filesystem.dest Filesystem.file_create_time | `drop_dm_object_name(Filesystem)` |
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `remcos_rat_file_creation_in_remcos_folder_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your