diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
index f9cb59a258..2915bc0bd6 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -9,10 +9,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
   to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries
   alike may abuse WMI and this commandlet for lateral movement and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
-  AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-WmiMethod*" AND ScriptBlockText="*-CN*"
+  AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
+  UserID | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.