diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
index 76c046406f..496dee8b71 100644
--- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml
+++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml
@@ -1,6 +1,6 @@
 name: 7zip CommandLine To SMB Share Path
 id: 01d29b48-ff6f-11eb-b81e-acde48001123
-version: 2
+version: 3
 date: '2024-05-17'
 author: Teoderick Contreras, Splunk
 status: production
@@ -14,7 +14,7 @@ description: The following analytic detects the execution of 7z or 7za processes
   sensitive information and potentially aiding further attacks.
 data_source:
 - Sysmon EventID 1
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+search: 'x| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name ="7z.exe"
   OR Processes.process_name = "7za.exe" OR Processes.original_file_name = "7z.exe"
   OR Processes.original_file_name =  "7za.exe") AND (Processes.process="*\\C$\\*"