duplicates

detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml

@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   parameter leverages WMI to query for all domain computers. Red Teams and adversaries
   may leverage this commandlet to enumerate domain computers for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
-  root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time)
+search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
+  root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_computer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable

detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml

@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
   and adversaries may leverage this commandlet to enumerate domain groups for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
-  root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time)
+search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
+  root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_group_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable