diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml
index b8f229bd70..10ec4eb2d1 100644
--- a/detections/endpoint/mshtml_module_load_in_office_product.yml
+++ b/detections/endpoint/mshtml_module_load_in_office_product.yml
@@ -14,7 +14,7 @@ description: The following detection identifies the module load of mshtml.dll in
 search: '`sysmon` EventID=7  process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe")
   ImageLoaded IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll")
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, process_name,
-  ImageLoaded, OriginalFileName, ProcessId | rename Computer as dest | `security_content_ctime(firstTime)`
+  ImageLoaded, OriginalFileName, ProcessGuid | rename Computer as dest | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process names and image loads from your endpoints. If you are using