diff --git a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
index 949e41dee4..3e9d0b3588 100644
--- a/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
+++ b/detections/endpoint/kerberos_service_ticket_request_using_rc4_encryption.yml
@@ -32,7 +32,7 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.001/impacket/windows-security.log
   kill_chain_phases:
-  - Privilege Escalation
+  - Exploitation
   mitre_attack_id:
   - T1558
   - T1558.001
@@ -55,9 +55,10 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Privilege Escalation
-  message: 
+  message: A Kerberos Service TTicket request with RC4 encryption was requested from $Client_Address$
   observable:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  asset_type: Endpoint
\ No newline at end of file