diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml
index 1fec236430..71c70e6b6c 100644
--- a/detections/application/crushftp_server_side_template_injection.yml
+++ b/detections/application/crushftp_server_side_template_injection.yml
@@ -27,7 +27,7 @@ tags:
   impact: 80
   message: Potential exploitation of CrushFTP Server Side Template Injection Vulnerability on $dest$ by $src_ip$.
   mitre_attack_id:
-  - T1192
+  - T1190
   observable:
   - name: dest
     type: IP Address
diff --git a/detections/endpoint/living_off_the_land_detection.yml b/detections/endpoint/living_off_the_land_detection.yml
index a4d21e3178..26f3ab58e1 100644
--- a/detections/endpoint/living_off_the_land_detection.yml
+++ b/detections/endpoint/living_off_the_land_detection.yml
@@ -25,7 +25,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_
   Off The Land" All_Risk.risk_object_type="system" by All_Risk.risk_object All_Risk.risk_object_type
   All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where
-  source_count >= 5 | `living_off_the_land_filter`'
+  source_count >= 5 | `living_off_the_land_detection_filter`'
 how_to_implement: To implement this correlation search a user needs to enable all
   detections in the Living Off The Land Analytic Story and confirm it is generating
   risk events. A simple search `index=risk analyticstories="Living Off The Land"`