diff --git a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
index 65508cee67..f412e936af 100644
--- a/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
+++ b/detections/endpoint/windows_bypass_uac_via_pkgmgr_tool.yml
@@ -37,7 +37,7 @@ tags:
   asset_type: Endpoint
   confidence: 30
   impact: 30
-  message: A pkgmgr.exe executed with package manager xml input file in $dest$
+  message: A pkgmgr.exe executed with package manager xml input file on $dest$
   mitre_attack_id:
   - T1548.002
   observable:
@@ -45,14 +45,10 @@ tags:
     type: User
     role:
     - Victim
-  - name: process_id
-    type: Process
+  - name: dest
+    type: Endpoint
     role:
-    - Attacker
-  - name: file_name
-    type: File Name
-    role:
-    - Attacker
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/windows_mark_of_the_web_bypass.yml b/detections/endpoint/windows_mark_of_the_web_bypass.yml
index c1f9a1e49b..86734f1975 100644
--- a/detections/endpoint/windows_mark_of_the_web_bypass.yml
+++ b/detections/endpoint/windows_mark_of_the_web_bypass.yml
@@ -12,7 +12,7 @@ description: The following analytic identifies a suspicious process that delete
   security restrictions within the Windows Operating System, particularly pertaining to files downloaded from the internet. 
   An example of this scenario is demonstrated by Ave Maria RAT, which attempts to delete this data stream as a means to evade such restrictions.
 search: '`sysmon` EventCode=23 TargetFilename = "*:Zone.Identifier" 
-  | stats  min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID Computer 
+  | stats  min(_time) as firstTime max(_time) as lastTime count by user EventCode Image TargetFilename ProcessID Computer | rename Computer as dest
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_mark_of_the_web_bypass_filter`'
@@ -28,7 +28,7 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: a mark-of-the-web data stream is deleted in $dest$
+  message: A mark-of-the-web data stream is deleted on $dest$
   mitre_attack_id:
   - T1553.005
   observable:
@@ -36,14 +36,10 @@ tags:
     type: User
     role:
     - Victim
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim
-  - name: deleted_files
-    type: File Name
-    role:
-    - Target
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml
index 88d123d25c..25159dabc3 100644
--- a/detections/endpoint/windows_unsigned_dll_side_loading.yml
+++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml
@@ -17,7 +17,7 @@ description: This analysis focuses on detecting potentially malicious unsigned D
   Detecting such suspicious DLLs is crucial in preventing privilege escalation attacks and other potential security breaches. Regular security assessments, thorough monitoring, 
   and implementing security best practices are essential in safeguarding systems from such threats.
 search: '`sysmon` EventCode=7 Signed=false OriginalFileName = "-" SignatureStatus="unavailable" ImageLoaded IN ("*:\\windows\\system32\\*", "*:\\windows\\syswow64\\*") 
-  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed SignatureStatus OriginalFileName process_name Computer EventCode ProcessId Hashes IMPHASH | rename Computer as dest
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_unsigned_dll_side_loading_filter`'
@@ -33,11 +33,11 @@ tags:
   asset_type: Endpoint
   confidence: 70
   impact: 70
-  message: an unsigned dll module was loaded in $dest$
+  message: An unsigned dll module was loaded on $dest$
   mitre_attack_id:
   - T1574.002
   observable:
-  - name: Computer
+  - name: dest
     type: Endpoint
     role:
     - Victim