diff --git a/detections/endpoint/windows_system_reboot_commandline.yml b/detections/endpoint/windows_system_reboot_commandline.yml
index 79a4ccb8d9..55ed3995c9 100644
--- a/detections/endpoint/windows_system_reboot_commandline.yml
+++ b/detections/endpoint/windows_system_reboot_commandline.yml
@@ -43,7 +43,7 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: process that execute reboot commandline in $dest$
+  message: Process $process_name$ that executed reboot via commandline on $dest$
   mitre_attack_id:
   - T1529
   nist: