diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml
index 8454154d22..bcc418af61 100644
--- a/detections/endpoint/domain_account_discovery_with_net_app.yml
+++ b/detections/endpoint/domain_account_discovery_with_net_app.yml
@@ -11,11 +11,11 @@ description: This search is to detect a process command line for AD discovery. T
   the targetted machine. This techique was seen in several malware as part of there
   recon and can be a good pivot of analysis.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "* user*" AND Processes.process
-  = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `domain_account_discovery_with_net_app_filter`'
+  as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process
+  = "* user*" AND Processes.process = "*/do*" by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `domain_account_discovery_with_net_app_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the