diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml
index f1dfc7f922..35150685ae 100644
--- a/detections/endpoint/cobalt_strike_named_pipes.yml
+++ b/detections/endpoint/cobalt_strike_named_pipes.yml
@@ -1,7 +1,7 @@
 name: Cobalt Strike Named Pipes
 id: 5876d429-0240-4709-8b93-ea8330b411b5
-version: 1
-date: '2021-02-22'
+version: 2
+date: '2022-05-16'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -17,9 +17,9 @@ description: 'The following analytic identifies the use of default or publicly k
   It is possible it was injected into by another process. Review recent parallel processes
   to identify suspicious patterns or behaviors. A parallel process may have a network
   connection, review and follow the connection back to identify any file modifications.'
-search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\wkssvc*, \\DserNamePipe*,
-  \\srvsvc_*, \\mojo.*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*,
-  \\ntsvcs*, \\winsock*, \\UIA_PIPE*) | stats count min(_time) as firstTime max(_time)
+search: '`sysmon` EventID=17 OR EventID=18 PipeName IN (\\msagent_*, \\DserNamePipe*,
+  \\srvsvc_*, \\postex_*, \\status_*, \\MSSE-*, \\spoolss_*, \\win_svc*,
+  \\ntsvcs*, \\winsock*, \\UIA_PIPE*)  | stats count min(_time) as firstTime max(_time)
   as lastTime by Computer, process_name, process_id process_path, PipeName | rename
   Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `cobalt_strike_named_pipes_filter`'