diff --git a/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
similarity index 95%
rename from detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml
rename to detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index 96485a65f1..9f725d5cd5 100644
--- a/detections/endpoint/powershell_fileless_process_injection___getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -1,4 +1,4 @@
-name: Powershell Fileless Process Injection - GetProcAddress
+name: Powershell Fileless Process Injection via GetProcAddress
 id: a26d9db4-c883-11eb-9d75-acde48001122
 version: 1
 date: '2021-06-08'
@@ -19,7 +19,7 @@ search: '`powershell` EventCode=4104
   | where getproc = 1
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
-  | `powershell_fileless_process_injection_(getprocaddress)_filter`'
+  | `powershell_fileless_process_injection_via_getprocaddress_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Limited false positives. Filter as needed.
 references:
diff --git a/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
similarity index 65%
rename from tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml
rename to tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
index 38abd78fd1..4622c2090a 100644
--- a/tests/endpoint/powershell_fileless_process_injection___getprocaddress.test.yml
+++ b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
@@ -1,7 +1,7 @@
-name: Powershell Fileless Process Injection (GetProcAddress) Unit Test
+name: Powershell Fileless Process Injection via GetProcAddress Unit Test
 tests:
-- name: Powershell Fileless Process Injection (GetProcAddress)
-  file: endpoint/powershell_fileless_process_injection___getprocaddress.yml
+- name: Powershell Fileless Process Injection via GetProcAddress
+  file: endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'