diff --git a/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml b/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
index ea923fda05..5e85f11fd5 100644
--- a/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
+++ b/detections/endpoint/ssa___windows_rundll32_comsvcs_memory_dump.yml
@@ -1,8 +1,8 @@
 name: Windows Rundll32 Comsvcs Memory Dump
 id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
-version: 4
+version: 5
 date: '2022-04-14'
-author: Jose Hernandez, Splunk
+author: Jose Hernandez, Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint_Processes
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
   null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
   "event_id"), "string", null) | where process IS NOT NULL AND process_name IS NOT
   NULL AND process_name LIKE "%rundll32.exe%"
-  AND match_regex(process, /(?i)MiniDump[\s;]+/)=true
+  AND match_regex(process, /(?i)minidump\s+/)=true
   AND match_regex(process, /(?i)comsvcs.dll\s+/)=true 
   | eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
   body=create_map(["event_id", event_id, "process_name", process_name, "process",