diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
index 23917623b0..82409f418b 100644
--- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
+++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml
@@ -1,7 +1,7 @@
 name: Linux Auditd Change File Owner To Root
 id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90
-version: 1
-date: '2024-09-04'
+version: 2
+date: '2024-10-09'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -14,7 +14,7 @@ description: The following analytic detects the use of the 'chown' command to ch
 data_source:
 - Linux Auditd Proctitle
 search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as
-  dest | where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %")
+  dest | where LIKE (process_exec, "%chown %root%")
   | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle
   normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
   `linux_auditd_change_file_owner_to_root_filter`'