diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
index 15c5181d89..ddfd760714 100644
--- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
@@ -35,7 +35,7 @@ tags:
   - DarkCrystal RAT
   - CISA AA22-257A
   - Qakbot
-  -   - Prestige Ransomware
+  - Prestige Ransomware
   confidence: 100
   context:
   - Source:Endpoint