diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index c4f2447379..c320eb40f9 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -10,24 +10,30 @@ description: The following analytic identifies parent processes, browsers, Windo
   terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
   many applications spawn cmd.exe natively or built into macros. Much of this will
   need to be tuned to further enhance the risk.
-search: '| from read_ssa_enriched_events()
+search: ''| from read_ssa_enriched_events()
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
-  | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
-  parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
-  null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
-  "dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
-  "string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
-  | where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
+  | eval process_name = ucast(map_get(input_event, "process_name"), "string", null),
+    parent_process_name = lower(ucast(input_event.parent_process_name, "string", null)),
+    cmd_line = lower(ucast(map_get(input_event, "process"),"string", null)),
+    dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string", null),
+    dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
+    event_id=ucast(map_get(input_event,"event_id"), "string", null)
+  | where process_name="cmd.exe"
+  | rex field=parent_process_name "(?<ParentBaseFileName>[^\\\\]+)$"
   | where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
-  OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
-  OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
-  OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
-  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
-  OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
-  IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
-  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
-  dest_user_id), body=create_map(["event_id", event_id,  "process_name", process_name,
-  "parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
+    OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
+    OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
+    OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe"
+    OR (ParentBaseFileName="java.exe"
+      AND (parent_process_name IS NOT NULL AND match_regex(parent_process_name, /(?i)patch1-Hotfix1a/)=false))
+    OR ParentBaseFileName="powershell.exe"
+    OR (ParentBaseFileName="chrome.exe"
+      AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)chrome-extension/)=false)))
+  | eval start_time=timestamp, end_time=timestamp,
+    entities=mvappend(dest_device_id, dest_user_id),
+    body=create_map(["event_id", event_id,  "process_name", process_name, "parent_process_name",
+      parent_process_name, "cmd_line", cmd_line, "ParentBaseFileName", ParentBaseFileName])
+  | into write_ssa_detected_events()'
 how_to_implement: In order to successfully implement this analytic, you will need
   endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
diff --git a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml b/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml
index 8b78331f05..b974348f97 100644
--- a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml
+++ b/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml
@@ -2,9 +2,9 @@ name: Detect Prohibited Applications Spawning cmd exe Unit Test
 tests:
   - name: Detect Prohibited Applications Spawning cmd exe
     file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
-    pass_condition: '@count_gt(0)'
+    pass_condition: '@count_gt(1)'
     description: Detect Prohibited Applications Spawning cmd exe
     attack_data:
       - file_name: windows-security.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
-        source: WinEventLog:Security
\ No newline at end of file
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/prohibited_cmd_spawn/prohibited_apps_spawning_cmd.log
+        source: WinEventLog:Security