diff --git a/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py
index 5723ce0fd..71dc20021 100644
--- a/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py
+++ b/volatility3/framework/plugins/windows/malware/unhooked_system_calls.py
@@ -18,7 +18,7 @@ from volatility3.plugins.windows import pslist, pe_symbols
 vollog = logging.getLogger(__name__)
 
 
-class unhooked_system_calls(interfaces.plugins.PluginInterface):
+class UnhookedSystemCalls(interfaces.plugins.PluginInterface):
     """Detects hooked ntdll.dll stub functions in Windows processes."""
 
     _required_framework_version = (2, 4, 0)
@@ -114,7 +114,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface):
         in different processes.
         This very effectively detects code injection.
         """
-        code_bytes: unhooked_system_calls._code_bytes_type = {}
+        code_bytes: UnhookedSystemCalls._code_bytes_type = {}
 
         procs = pslist.PsList.list_processes(self.context, kernel_module_name)
 
@@ -154,7 +154,7 @@ class unhooked_system_calls(interfaces.plugins.PluginInterface):
             context=self.context,
             config_path=self.config_path,
             kernel_module_name=self.config["kernel"],
-            symbols=unhooked_system_calls.system_calls,
+            symbols=UnhookedSystemCalls.system_calls,
         )
 
         # code_bytes[dll_name][func_name][func_bytes]
diff --git a/volatility3/framework/plugins/windows/unhooked_system_calls.py b/volatility3/framework/plugins/windows/unhooked_system_calls.py
index 0c42415b6..e6fb2fb6c 100644
--- a/volatility3/framework/plugins/windows/unhooked_system_calls.py
+++ b/volatility3/framework/plugins/windows/unhooked_system_calls.py
@@ -8,10 +8,10 @@ from volatility3.plugins.windows.malware import unhooked_system_calls
 vollog = logging.getLogger(__name__)
 
 
-class unhooked_system_calls(
+class UnhookedSystemCalls(
     interfaces.plugins.PluginInterface,
     deprecation.PluginRenameClass,
-    replacement_class=unhooked_system_calls.unhooked_system_calls,
+    replacement_class=unhooked_system_calls.UnhookedSystemCalls,
     removal_date="2026-06-07",
 ):
     """Detects hooked ntdll.dll stub functions in Windows processes (deprecated)."""