diff --git a/rules/evtx/antivirus/f-secure_legacy.yml b/rules/evtx/antivirus/f-secure_legacy.yml
index 626abfac..79731740 100644
--- a/rules/evtx/antivirus/f-secure_legacy.yml
+++ b/rules/evtx/antivirus/f-secure_legacy.yml
@@ -24,7 +24,7 @@ fields:
   - name: Threat Name
     to: Event.EventData.MessageText
   - name: Threat Path
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 filter:
   Event.System.Provider:
diff --git a/rules/evtx/antivirus/kaspersky.yml b/rules/evtx/antivirus/kaspersky.yml
index ca245556..2b39697f 100644
--- a/rules/evtx/antivirus/kaspersky.yml
+++ b/rules/evtx/antivirus/kaspersky.yml
@@ -20,9 +20,9 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Name
-    to: Event.EventData.Data[1]
+    to: Event.EventData.Data.#text[1]
   - name: Threat Path
-    to: Event.EventData.Data[0]
+    to: Event.EventData.Data.#text[0]
 
 
 filter:
diff --git a/rules/evtx/antivirus/mcafee.yml b/rules/evtx/antivirus/mcafee.yml
index 04fd43d2..586c3956 100644
--- a/rules/evtx/antivirus/mcafee.yml
+++ b/rules/evtx/antivirus/mcafee.yml
@@ -20,7 +20,7 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Name
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 filter:
   Event.System.Provider:
diff --git a/rules/evtx/antivirus/sophos.yml b/rules/evtx/antivirus/sophos.yml
index 97668b94..87a9d887 100644
--- a/rules/evtx/antivirus/sophos.yml
+++ b/rules/evtx/antivirus/sophos.yml
@@ -20,14 +20,14 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Type
-    to: Event.EventData.Data[0]
+    to: Event.EventData.Data.#text[0]
   - name: Threat Name
-    to: Event.EventData.Data[2]
+    to: Event.EventData.Data.#text[2]
   - name: Threat Path
-    to: Event.EventData.Data[1]
+    to: Event.EventData.Data.#text[1]
   - name: SHA1
     container:
-      field: Event.EventData.Data[4]
+      field: Event.EventData.Data.#text[4]
       format: json
     to: sha1FileHash  
 
diff --git a/rules/evtx/antivirus/symantec.yml b/rules/evtx/antivirus/symantec.yml
index 4bdfe3c6..422e3901 100644
--- a/rules/evtx/antivirus/symantec.yml
+++ b/rules/evtx/antivirus/symantec.yml
@@ -20,7 +20,7 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: Threat Name
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 filter:
   Event.System.Provider: Symantec Endpoint Protection Client
diff --git a/rules/evtx/antivirus/windows_security_essentials.yml b/rules/evtx/antivirus/windows_security_essentials.yml
index 88c3bddf..50ad0c70 100644
--- a/rules/evtx/antivirus/windows_security_essentials.yml
+++ b/rules/evtx/antivirus/windows_security_essentials.yml
@@ -20,11 +20,11 @@ fields:
   - name: Computer
     to: Event.System.Computer
   - name: User
-    to: Event.EventData.Data[19]
+    to: Event.EventData.Data.#text[19]
   - name: Threat Name
-    to: Event.EventData.Data[7]
+    to: Event.EventData.Data.#text[7]
   - name: Threat Path
-    to: Event.EventData.Data
+    to: Event.EventData.Data.#text
 
 
 filter: