diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml
index 7cadfcbe50..02b3110392 100644
--- a/detections/endpoint/extraction_of_registry_hives.yml
+++ b/detections/endpoint/extraction_of_registry_hives.yml
@@ -1,7 +1,7 @@
 name: Extraction of Registry Hives
 id: 8bbb7d58-b360-11eb-ba21-acde48001122
-version: 1
-date: '2021-05-12'
+version: 2
+date: '2021-09-09'
 author: Michael Haag, Splunk
 type: TTP
 datamodel:
@@ -12,8 +12,8 @@ description: The following analytic identifies the use of `reg.exe` exporting Wi
   a untrusted process or script. Upon execution, a file will be written to disk.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=reg.exe
-  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process=*\sam
-  * OR Processes.process=*system* OR Processes.process=*security*) by Processes.dest
+  (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam
+  *" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest
   Processes.user Processes.parent_process Processes.process_name Processes.process
   Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`'