diff --git a/detections/cscript_via_cmd.yml b/detections/cscript_via_cmd.yml
index d1756b28c4..f779fa04b3 100644
--- a/detections/cscript_via_cmd.yml
+++ b/detections/cscript_via_cmd.yml
@@ -34,7 +34,7 @@ detect:
         latest_time: -10m@m
       search: '| tstats `security_content_summariesonly` count values(Processes.process) min(_time)
         as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
-        Processes.parent_process="*cmd.exe" (Processes.process_name=cscript.exe OR
+        Processes.parent_process_name="cmd.exe" (Processes.process_name=cscript.exe OR
         Processes.process_name =wscript.exe) by Processes.parent_process Processes.process_name
         Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`'
       suppress: