diff --git a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
index 9a10c51742..157161f0b0 100644
--- a/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
+++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml
@@ -12,11 +12,18 @@ description: The following analytic identifies executable files (.exe or .dll) b
   endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral
   movement and remote code execution. The Trickbot malware family also implements
   this behavior to try to infect other machines in the infected network.
-search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll")
-  Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask=
-  "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode
-  Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executable_file_written_in_administrative_smb_share_filter`'
+search: '`wineventlog_security` 
+    EventCode=5145 
+    (Relative_Target_Name IN ("*.exe","*.dll") OR RelativeTargetName IN ("*.exe","*.dll"))
+    (Object_Type=File OR ObjectType=File)
+    (Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") OR ShareName IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$"))
+    (Access_Mask= "0x2" OR AccessMask= "0x2") 
+| eval Relative_Target_Name=coalesce("Relative_Target_Name", "RelativeTargetName"), 
+    Object_Type=coalesce(Object_Type, ObjectType),
+    Share_Name=coalesce(Share_Name, ShareName),
+    Access_Mask=coalesce(Access_Mask, AccessMask),
+    Source_Address=coalesce(Source_Address, IpAddress)
+| stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask src_user src_port Source_Address'
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also
   required. Also enable the object Audit access success/failure in your group policy.
@@ -41,6 +48,7 @@ tags:
   - Stage:Lateral Movement
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/exe_smbshare/windows-security-xml.log
   impact: 70
   kill_chain_phases:
   - Exploitation