From dec5103005cda2a77819aff2692830e7f2cd09cd Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Tue, 22 Mar 2022 17:29:42 +0100
Subject: [PATCH 01/11] pwh_xml

---
 ...passwordpolicy_with_powershell_script_block.yml | 13 +++++++------
 ...get_domainuser_with_powershell_script_block.yml | 14 ++++++++------
 .../getlocaluser_with_powershell_script_block.yml  | 12 +++++++-----
 ...ordpolicy_with_powershell_script_block.test.yml |  4 ++--
 ...omainuser_with_powershell_script_block.test.yml |  4 ++--
 ...localuser_with_powershell_script_block.test.yml |  4 ++--
 6 files changed, 28 insertions(+), 23 deletions(-)

diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
index e3f82c3ef5..005a203fc5 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
 id: 1ff7ccc8-065a-11ec-91e4-acde48001122
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-03-22'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,9 +10,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   used to obtain the password policy in a Windows domain. Red Teams and adversaries
   alike may use PowerShell to enumerate domain policies for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -30,7 +31,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
index ea6ea56233..c3f3fe2e49 100644
--- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get DomainUser with PowerShell Script Block
 id: 61994268-04f4-11ec-865c-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-03-22'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,11 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
   Red Teams and adversaries alike may use PowerView to enumerate domain users for
   situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `get_domainuser_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
@@ -27,7 +29,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log
   impact: 50
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
index a6c2f2d230..2a1551d5fd 100644
--- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml
+++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetLocalUser with PowerShell Script Block
 id: 2e891cbe-0426-11ec-9c9c-acde48001122
-version: 1
-date: '2021-08-23'
+version: 2
+date: '2022-03-22'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,8 +10,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   commandlet is used to return a list of all local users. Red Teams and adversaries
   may leverage this commandlet to enumerate users for situational awareness and Active
   Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-LocalUser*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-LocalUser*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `getlocaluser_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -28,7 +30,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
index b7d0e8d41d..54698c854e 100644
--- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: WinEventLog
diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
index 8dd994abfb..c945175123 100644
--- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: WinEventLog
diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
index ccb3289680..c48933428f 100644
--- a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: wineventlog

From b2ef5deb63fc57ec6a19f03252f75d848c86c2cb Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:00:02 +0100
Subject: [PATCH 02/11] Update
 get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml

---
 ...ltdomainpasswordpolicy_with_powershell_script_block.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
index 54698c854e..4da2d30ab5 100644
--- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+    sourcetype: xmlwineventlog

From ad01d9e57f6a29c819801b252975c2ad9a414f99 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:00:12 +0100
Subject: [PATCH 03/11] Update
 get_domainuser_with_powershell_script_block.test.yml

---
 .../get_domainuser_with_powershell_script_block.test.yml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
index c945175123..db4db3c6a6 100644
--- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+    sourcetype: xmlwineventlog

From 53c54fe6f12915095e7d04b1f9fc5dafa2b0e595 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:00:21 +0100
Subject: [PATCH 04/11] Update
 getlocaluser_with_powershell_script_block.test.yml

---
 .../endpoint/getlocaluser_with_powershell_script_block.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
index c48933428f..ec79c1c88a 100644
--- a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+    sourcetype: xmlwineventlog

From fc2114b043b96128eb21d5c21af614a21dd1194e Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:11:04 +0100
Subject: [PATCH 05/11] Update
 get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml

---
 ...ltdomainpasswordpolicy_with_powershell_script_block.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
index 4da2d30ab5..f582bda359 100644
--- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
+  - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From 0514236e65964134cedd57fff8640520eb350d6a Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:11:14 +0100
Subject: [PATCH 06/11] Update
 get_domainuser_with_powershell_script_block.test.yml

---
 .../get_domainuser_with_powershell_script_block.test.yml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
index db4db3c6a6..53fd5e1b21 100644
--- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
+  - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From 313315da7c2feed209de264e932e3e9038daac6a Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:11:25 +0100
Subject: [PATCH 07/11] Update
 getlocaluser_with_powershell_script_block.test.yml

---
 .../endpoint/getlocaluser_with_powershell_script_block.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
index ec79c1c88a..b2abc4915b 100644
--- a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
+  - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From b9a82c044116068dd7cee1c68c806d342cbaee0c Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:24:19 +0100
Subject: [PATCH 08/11] Update
 get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml

---
 ...ltdomainpasswordpolicy_with_powershell_script_block.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
index f582bda359..48001f2acc 100644
--- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: xmlwineventlog
+    sourcetype: XmlWinEventLog

From dc91b8d6ef73955f558e7b7782bda12d0e78e884 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:24:29 +0100
Subject: [PATCH 09/11] Update
 get_domainuser_with_powershell_script_block.test.yml

---
 .../get_domainuser_with_powershell_script_block.test.yml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
index 53fd5e1b21..c943f9ecea 100644
--- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: xmlwineventlog
+    sourcetype: XmlWinEventLog

From 7d0f553d6bb952ea6232a6eea414ac421dd39a85 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Tue, 22 Mar 2022 18:24:41 +0100
Subject: [PATCH 10/11] Update
 getlocaluser_with_powershell_script_block.test.yml

---
 .../endpoint/getlocaluser_with_powershell_script_block.test.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
index b2abc4915b..3303bde512 100644
--- a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: xmlwineventlog
+    sourcetype: XmlWinEventLog

From f69fce02dc105ae50851229558e40f25d2599c36 Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Wed, 23 Mar 2022 10:59:43 +0100
Subject: [PATCH 11/11] pwh_xml

---
 ...et_foresttrust_with_powershell_script_block.yml | 12 +++++++-----
 ...t_group_discovery_with_script_block_logging.yml | 13 +++++++------
 .../getadgroup_with_powershell_script_block.yml    | 12 +++++++-----
 ...etcurrent_user_with_powershell_script_block.yml | 13 +++++++------
 ..._session_on_remote_endpoint_with_powershell.yml | 14 ++++++++------
 ...resttrust_with_powershell_script_block.test.yml |  8 ++++----
 ...up_discovery_with_script_block_logging.test.yml |  8 ++++----
 ...etadgroup_with_powershell_script_block.test.yml |  8 ++++----
 ...rent_user_with_powershell_script_block.test.yml |  8 ++++----
 ...ion_on_remote_endpoint_with_powershell.test.yml |  8 ++++----
 10 files changed, 56 insertions(+), 48 deletions(-)

diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
index e2a7d111b8..13ccd845b2 100644
--- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
@@ -17,13 +17,15 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by  Message OpCode ComputerName User EventCode
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `get_foresttrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: False positives may be present. Tune as needed.
 references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/
 tags:
@@ -34,7 +36,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
index 7f98cc9d4f..edc3ded04c 100644
--- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
@@ -1,7 +1,7 @@
 name: Get WMIObject Group Discovery with Script Block Logging
 id: 69df7f7c-155d-11ec-a055-acde48001122
-version: 1
-date: '2021-09-14'
+version: 2
+date: '2022-03-22'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel: []
@@ -18,9 +18,10 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*Get-WMIObject*" AND Message = "*Win32_Group*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by  Message OpCode
-  ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText = "*Win32_Group*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `get_wmiobject_group_discovery_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -41,7 +42,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml
index 5cb62613c8..218a2cc609 100644
--- a/detections/endpoint/getadgroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetAdGroup with PowerShell Script Block
 id: e4c73d68-794b-468d-b4d0-dac1772bbae7
-version: 1
-date: '2021-08-25'
+version: 2
+date: '2022-03-22'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,8 +10,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is used to return a list of all domain groups. Red Teams and adversaries may leverage
   this commandlet to enumerate domain groups for situational awareness and Active
   Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ADGroup*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `getadgroup_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -29,7 +31,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index 626ea184b4..331d62cc82 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetCurrent User with PowerShell Script Block
 id: 80879283-c30f-44f7-8471-d1381f6d437a
-version: 1
-date: '2021-09-13'
+version: 2
+date: '2022-03-22'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,9 +10,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   class. This method returns an object that represents the current Windows user. Red
   Teams and adversaries may leverage this method to identify the logged user on a
   compromised endpoint for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*"
-  AND Message = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*"  ScriptBlockText = "*GetCurrent()*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
   | `getcurrent_user_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,7 +31,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index fb3cf0b8b6..617410547e 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Interactive Session on Remote Endpoint with PowerShell
 id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
-version: 2
-date: '2022-02-18'
+version: 3
+date: '2022-03-22'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,11 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams
   and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement
   and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-ComputerName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer user_id 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `interactive_session_on_remote_endpoint_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -30,7 +32,7 @@ tags:
   - Source:Endpoint
   - Stage:Lateral Movement
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml.log
   impact: 90
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml b/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml
index dda8e77910..58b0b2f3f0 100644
--- a/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog:Microsoft-Windows-PowerShell/Operational
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
diff --git a/tests/endpoint/get_wmiobject_group_discovery_with_script_block_logging.test.yml b/tests/endpoint/get_wmiobject_group_discovery_with_script_block_logging.test.yml
index 6fab339403..61586a224b 100644
--- a/tests/endpoint/get_wmiobject_group_discovery_with_script_block_logging.test.yml
+++ b/tests/endpoint/get_wmiobject_group_discovery_with_script_block_logging.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getadgroup_with_powershell_script_block.test.yml b/tests/endpoint/getadgroup_with_powershell_script_block.test.yml
index f46f12e127..8a1c09ec41 100644
--- a/tests/endpoint/getadgroup_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getadgroup_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml b/tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml
index ad6904eb49..34e798cbcc 100644
--- a/tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml b/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml
index c768354c5c..521704fd88 100644
--- a/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml
+++ b/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: windows-powershell-xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog