diff --git a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
index 43079b5003..ae479ce155 100644
--- a/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
+++ b/detections/endpoint/windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
@@ -34,7 +34,7 @@ tags:
   confidence: 90
   context:
   - Source:Endpoint
-  - Stage:Command and Control
+  - Stage:Command And Control
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log
   impact: 90
@@ -63,4 +63,4 @@ tags:
   - Computer 
   - UserID
   risk_score: 81
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint