diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
index 88a9dcb2c6..14cce5e19f 100644
--- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
@@ -23,7 +23,7 @@ search: '|tstats `security_content_summariesonly` values(Filesystem.file_path) a
   OR Filesystem.file_path = *\\Windows\\Media\\* OR Filesystem.file_path = *\\Windows\\repair\\*
   OR Filesystem.file_path = *\\AppData\\Local\\Temp* OR Filesystem.file_path = *\\PerfLogs\\*)
   by Filesystem.file_create_time Filesystem.process_id  Filesystem.file_name Filesystem.user
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `executables_or_script_creation_in_suspicious_path_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the Filesystem responsible for the changes from