diff --git a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml
index a703812780..b41c548119 100644
--- a/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml
+++ b/detections/endpoint/windows_lolbas_executed_as_renamed_file.yml
@@ -36,15 +36,15 @@ tags:
   - T1218.011
   observable: 
   - name: dest
-    type: system
+    type: Hostname
     role:
     - Victim
   - name: user
-    type: user
+    type: User
     role:
     - Victim
   - name: process_name
-    type: process_name
+    type: Process Name
     role:
     - Attacker
   product: 
@@ -65,4 +65,4 @@ tests:
   attack_data:
   - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/cmd_lolbas_usage/cmd_lolbas_usage.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog