correcting analytic type

detections/endpoint/getlocaluser_with_powershell.yml

@@ -3,7 +3,7 @@ id: 85fae8fa-0427-11ec-8b78-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: hunt
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line

detections/endpoint/getlocaluser_with_powershell_script_block.yml

@@ -3,7 +3,7 @@ id: 2e891cbe-0426-11ec-9c9c-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)

detections/endpoint/getwmiobject_user_account_with_powershell.yml

@@ -3,14 +3,14 @@ id: b44f6ac6-0429-11ec-87e9-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users.  
   Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* OR Processes.process=*Win32_UserAccount*)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`'

detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml

@@ -3,7 +3,7 @@ id: 640b0eda-0429-11ec-accd-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)

detections/endpoint/local_account_discovery_with_net.yml

@@ -3,7 +3,7 @@ id: 5d0d4830-0133-11ec-bae3-acde48001122
 version: 1
 date: '2021-08-19'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line

detections/endpoint/local_account_discovery_with_wmic.yml

@@ -3,7 +3,7 @@ id: 4902d7aa-0134-11ec-9d65-acde48001122
 version: 1
 date: '2021-08-19'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line