diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index f7d2a8d1fd..6e8026e954 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for the creation of local administrator accounts using
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
-  user values(Processes.parent_process) as parent_process min(_time) as firstTime
+  user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
   OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators*
   OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR