diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
index c89705905e..b1fdf11508 100644
--- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
+++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml
@@ -9,10 +9,12 @@ description: This search looks for specific authentication events from the Windo
   Security Event logs to detect potential attempts at using the Pass-the-Hash technique.
 data_source:
 - Windows Security 4624
-search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9
-  Logon_Process=seclogo) | fillnull | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode, Logon_Type, WorkstationName, user, dest | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `detect_activity_related_to_pass_the_hash_attacks_filter` '
+search: '`wineventlog_security` EventCode=4624 (Logon_Type=3 Logon_Process=NtLmSsp WorkstationName=WORKSTATION NOT AccountName="ANONYMOUS LOGON") OR (Logon_Type=9 Logon_Process=seclogo) 
+| fillnull 
+| stats count min(_time) as firstTime max(_time) as lastTime by EventCode, Logon_Type, WorkstationName, user, dest 
+| `security_content_ctime(firstTime)`
+| `security_content_ctime(lastTime)` 
+| `detect_activity_related_to_pass_the_hash_attacks_filter`'
 how_to_implement: To successfully implement this search, you must ingest your Windows
   Security Event logs and leverage the latest TA for Windows.
 known_false_positives: Legitimate logon activity by authorized NTLM systems may be