diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml
index ec8dfcc08a..9a1c7a04c3 100644
--- a/detections/endpoint/suspicious_rundll32_rename.yml
+++ b/detections/endpoint/suspicious_rundll32_rename.yml
@@ -65,7 +65,7 @@ tags:
   context:
   - Source: Endpoint
   - Stage: Initial Access, Execution, Defense Evasion
-  message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user
+  message: Suspicious renamed rundll32.exe binary ran on $dest$ by $user$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
index 244dd84d72..cd741a39fe 100644
--- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
+++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml
@@ -57,7 +57,7 @@ tags:
   context:
   - Source: Endpoint
   - Stage: Initial Access, Execution, Defense Evasion
-  message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user 
+  message: Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
index 4ebcc27913..db73de3a45 100644
--- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml
+++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml
@@ -64,7 +64,7 @@ tags:
   - Stage: Initial Access, Execution
   message: Possible CVE-2021-26857 exploitation on $dest$
   observable:
-  - name: $dest
+  - name: dest
     type: Endpoint
     role:
     - Victim
\ No newline at end of file