diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
index f4b731c9fa..e5cf6b75a4 100644
--- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
+++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
@@ -11,7 +11,7 @@ description: 'The following analytic identifies one source endpoint failing to a
   an adversary performing a Password Spraying attack against an Active Directory environment
   using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when 
   the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 
-  0x18 stands for `wrong passowrd provided` (the attempted user is a legitimate domain user).\
+  0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\
 
   The detection calculates the standard deviation for each host and leverages 
   the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic,