diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml
index bc2838bf91..6e1b378c86 100644
--- a/detections/endpoint/print_processor_registry_autostart.yml
+++ b/detections/endpoint/print_processor_registry_autostart.yml
@@ -48,7 +48,7 @@ drilldown_searches:
   earliest_offset: $info_min_time$
   latest_offset: $info_max_time$
 rba:
-  message: modified/added/deleted registry entry $Registry.registry_path$ on $dest$
+  message: modified/added/deleted registry entry $registry_path$ on $dest$
   risk_objects:
   - field: dest
     type: system