diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml
index 22dce62ed2..93840b2101 100644
--- a/detections/endpoint/detect_html_help_renamed.yml
+++ b/detections/endpoint/detect_html_help_renamed.yml
@@ -20,7 +20,7 @@ description: The following analytic identifies a renamed instance of hh.exe (HTM
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_hh` by Processes.dest
   Processes.user Processes.parent_process_name Processes.original_file_name Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_html_help_renamed_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information