diff --git a/detections/unsigned_image_loaded_by_lsass.yml b/detections/unsigned_image_loaded_by_lsass.yml
index eb06175fb6..64f28e3eb3 100644
--- a/detections/unsigned_image_loaded_by_lsass.yml
+++ b/detections/unsigned_image_loaded_by_lsass.yml
@@ -1,6 +1,4 @@
-name: Unsigned Image Loaded by LSASS
-id: 56ef054c-76ef-45f9-af4a-a634695dcd65
-version: 1
+author: Patrick Bareiss, Splunk
 date: '2019-12-06'
 description: This search detects loading of unsigned images by LSASS.
 how_to_implement: This search needs Sysmon Logs with a sysmon configuration, which
@@ -9,27 +7,30 @@ how_to_implement: This search needs Sysmon Logs with a sysmon configuration, whi
   (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
   with configurations for your Splunk environment. The search also uses a post-filter
   macro designed to filter out known false positives.
-type: ESCU
+id: 56ef054c-76ef-45f9-af4a-a634695dcd65
+known_false_positives: Other tools could load images into LSASS for legitimate reason.
+  But enterprise tools should always use signed DLLs.
+name: Unsigned Image Loaded by LSASS
 references:
 - https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
-author: Patrick Bareiss, Splunk
 search: '`sysmon` EventID=7 Image=*lsass.exe Signed=false | stats count min(_time)
   as firstTime max(_time) as lastTime by Computer, Image, ImageLoaded, Signed, SHA1
   | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `unsigned_image_loaded_by_lsass_filter` '
-known_false_positives: Other tools could load images into LSASS for legitimate reason.
-  But enterprise tools should always use signed DLLs.
 tags:
   analytics_story:
   - Credential Dumping
-  mitre_attack_id:
-  - T1003.001
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: Windows
+  automated_detection_testing: passed
   cis20:
   - CIS 8
   - CIS 16
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1003.001
   nist:
   - DE.CM
   security_domain: endpoint
-  asset_type: Windows
+type: ESCU
+version: 1