diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
index f67a0f1795..f0eaf1cd60 100644
--- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml
+++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml
@@ -12,8 +12,7 @@ data_source:
 - Sysmon Event ID 7
 search: '`sysmon` EventCode=7 ImageLoaded="*\\colorui.dll" process_name != "colorcpl.exe"
   NOT(Image IN("*\\windows\\*", "*\\program files*")) | stats count min(_time) as
-  firstTime max(_time) as lastTime by Image ImageLoaded process_name dest user EventCode
-  Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  firstTime max(_time) as lastTime by Image ImageLoaded process_name dest user_id EventCode Signed ProcessId | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `uac_bypass_with_colorui_com_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -29,16 +28,11 @@ tags:
   asset_type: Endpoint
   confidence: 80
   impact: 60
-  message: The following module $ImageLoaded$ was loaded by a non-standard application
-    on endpoint $dest$ by user $user$.
+  message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $dest$.
   mitre_attack_id:
   - T1218
   - T1218.003
   observable:
-  - name: user
-    type: User
-    role:
-    - Victim
   - name: dest
     type: Hostname
     role: