diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
index 85d1f0325e..9c632db1d6 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   parameter leverages WMI to query for all domain computers. Red Teams and adversaries
   may leverage this commandlet to enumerate domain computers for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
-  root\\directory\\ldap"* AND Message=*"class ds_computer"*) | stats count min(_time)
+search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
+  root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_computer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
index 90cb20dc8b..2d3d5d7a09 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
   and adversaries may leverage this commandlet to enumerate domain groups for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace
-  root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time)
+search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
+  root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_group_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable