diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
index 90587f65be..09aea2c512 100644
--- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml
@@ -50,7 +50,7 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: Svchost.exe spawned a LOLBAS process on $dest
+  message: Svchost.exe spawned a LOLBAS process on $dest$
   mitre_attack_id:
   - T1053
   - T1053.005