diff --git a/detections/system_information_discovery_detection.yml b/detections/system_information_discovery_detection.yml
index c5dc66797b..f1a0cd0652 100644
--- a/detections/system_information_discovery_detection.yml
+++ b/detections/system_information_discovery_detection.yml
@@ -1,12 +1,13 @@
-author: Patrick Bareiss, Splunk
+name: System Information Discovery Detection
+id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
+version: 1
 date: '2020-10-12'
 description: Detect system information discovery techniques used by attackers to understand
   configurations of the system to further exploit it.
-id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
-known_false_positives: Administrators debugging servers
-name: System Information Discovery Detection
+type: ESCU
 references:
 - https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
+author: Patrick Bareiss, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
   OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
@@ -15,6 +16,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
   by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `system_information_discovery_detection_filter`'
+known_false_positives: Administrators debugging servers
 tags:
   analytics_story:
   - Discovery Techniques
@@ -29,5 +31,3 @@ tags:
   nist:
   - DE.CM
   security_domain: endpoint
-type: ESCU
-version: 1