diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml
index d1c12f8291..8f1590589b 100644
--- a/detections/endpoint/potentially_malicious_code_on_commandline.yml
+++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml
@@ -60,13 +60,13 @@ tags:
   context:
     - source:endpoint
     - stage:Execution
-  message: Unusual commandline execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
+  message: Unusual command-line execution with hallmarks of malicious activity run by $user$ found on $dest$ with commandline $process$
   observable:
-    - name: ComputerName
+    - name: dest
       type: Hostname
       role:
         - Victim
-    - name: User
+    - name: user
       type: User
       role:
         - Victim
\ No newline at end of file