diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml
index d87e356c47..21249e50e2 100644
--- a/detections/endpoint/linux_decode_base64_to_shell.yml
+++ b/detections/endpoint/linux_decode_base64_to_shell.yml
@@ -45,7 +45,7 @@ tags:
   - T1059.004
   nist:
   - DE.CM
-   observable:
+  observable:
   - name: user
     type: User
     role: