diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index e7fb014fc2..d377d2527e 100644
--- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
            match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR
            match_regex(cmd_line, /(?i)kerberos::golden/)=true OR
            match_regex(cmd_line, /(?i)kerberos::silver/)=true OR
-           match_regex(cmd_line, /(?i)token::elevate/)=true OR
+           match_regex(cmd_line, /(?i)token::elevate/)=true
         )
 
 | eval start_time = timestamp,