diff --git a/detections/endpoint/potential_password_in_username.yml b/detections/endpoint/potential_password_in_username.yml
index ee672b6ca4..6663127819 100644
--- a/detections/endpoint/potential_password_in_username.yml
+++ b/detections/endpoint/potential_password_in_username.yml
@@ -19,7 +19,7 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime
   | lookup ut_shannon_lookup word AS user
   | where ut_shannon>3 AND len(user)>=8 AND mvcount(src) == 1
   | sort count, - ut_shannon 
-  | eval incorrect_password=user
+  | eval incorrect_cred=user
   | eval endtime=endtime+1000
   | map maxsearches=70 search="| tstats `security_content_summariesonly`
   earliest(_time) AS starttime latest(_time) AS endtime latest(sourcetype) AS sourcetype
@@ -29,10 +29,10 @@ search: '| tstats `security_content_summariesonly` earliest(_time) AS starttime
   earliest=\"$starttime$\" latest=\"$endtime$\" BY \"Authentication.user\"
   | `drop_dm_object_name(\"Authentication\")`
   | `potential_password_in_username_false_positive_reduction`
-  | eval incorrect_password=\"$incorrect_password$\"
+  | eval incorrect_cred=\"$incorrect_cred$\"
   | eval ut_shannon=\"$ut_shannon$\"
   | sort count"
-  | where user!=incorrect_password 
+  | where user!=incorrect_cred
   | outlier action=RM count
   | `potential_password_in_username_filter`'
 how_to_implement: To successfully implement this search, you need to have relevant
@@ -92,4 +92,4 @@ tags:
   - Authentication.dest
   - sourcetype
   risk_score: 21
-  security_domain: access
\ No newline at end of file
+  security_domain: access