diff --git a/detections/endpoint/windows_dll_side_loading_in_calc.yml b/detections/endpoint/windows_dll_side_loading_in_calc.yml
index 16d59c55a5..6b22476513 100644
--- a/detections/endpoint/windows_dll_side_loading_in_calc.yml
+++ b/detections/endpoint/windows_dll_side_loading_in_calc.yml
@@ -35,7 +35,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: 
+  message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$
   mitre_attack_id:
   - T1574.002
   - T1574
@@ -61,4 +61,4 @@ tags:
   - ProcessId
   risk_score: 90
   security_domain: endpoint
-  asset_type: Endpoint
\ No newline at end of file
+  asset_type: Endpoint