From cf31629e06f5371724ee60a65b3fd51ecceace4d Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 25 Feb 2022 15:30:49 -0700
Subject: [PATCH 01/48] Converted detections to XML

---
 .../adsisearcher_account_discovery.yml        | 25 +++++-----
 ...allow_inbound_traffic_in_firewall_rule.yml | 27 +++++-----
 .../delete_shadowcopy_with_powershell.yml     | 27 +++++-----
 ...f_shadowcopy_with_script_block_logging.yml | 29 ++++++-----
 ...e_with_powershell_script_block_logging.yml | 23 ++++-----
 ...z_with_powershell_script_block_logging.yml | 22 +++++----
 ...thentication_discovery_with_get_aduser.yml | 19 ++++---
 ...uthentication_discovery_with_powerview.yml | 17 ++++---
 ...main_group_discovery_with_adsisearcher.yml | 21 ++++----
 ...levated_group_discovery_with_powerview.yml | 17 ++++---
 ...ltdomainpasswordpolicy_with_powershell.yml |  9 ++--
 ...ordpolicy_with_powershell_script_block.yml | 23 +++++----
 ...et_aduser_with_powershell_script_block.yml | 25 +++++-----
 ...ordpolicy_with_powershell_script_block.yml | 25 +++++-----
 .../get_domainpolicy_with_powershell.yml      |  9 ++--
 ...ainpolicy_with_powershell_script_block.yml | 21 ++++----
 ...maintrust_with_powershell_script_block.yml | 25 +++++-----
 ...omainuser_with_powershell_script_block.yml | 25 +++++-----
 ...resttrust_with_powershell_script_block.yml | 26 +++++-----
 ...up_discovery_with_script_block_logging.yml | 21 ++++----
 ...dcomputer_with_powershell_script_block.yml | 19 ++++---
 ...etadgroup_with_powershell_script_block.yml | 18 ++++---
 ...rent_user_with_powershell_script_block.yml | 19 ++++---
 ...ncomputer_with_powershell_script_block.yml | 20 ++++----
 ...ontroller_with_powershell_script_block.yml | 19 ++++---
 ...maingroup_with_powershell_script_block.yml | 19 ++++---
 ...localuser_with_powershell_script_block.yml | 15 ++++--
 ...onnection_with_powershell_script_block.yml | 19 ++++---
 ..._computer_with_powershell_script_block.yml | 19 ++++---
 ..._ds_group_with_powershell_script_block.yml | 17 ++++---
 ...t_ds_user_with_powershell_script_block.yml | 21 ++++----
 ...r_account_with_powershell_script_block.yml | 13 +++--
 ...ion_on_remote_endpoint_with_powershell.yml | 20 ++++----
 ...tication_flag_disabled_with_powershell.yml | 18 ++++---
 .../endpoint/mailsniper_invoke_functions.yml  | 23 +++++----
 .../endpoint/powershell_4104_hunting.yml      | 49 ++++++++++---------
 .../powershell_creating_thread_mutex.yml      | 23 ++++-----
 .../powershell_domain_enumeration.yml         | 19 +++----
 ...powershell_enable_smb1protocol_feature.yml | 15 +++---
 .../powershell_execute_com_object.yml         | 21 +++++---
 ...s_process_injection_via_getprocaddress.yml | 21 ++++----
 ...script_contains_base64_encoded_content.yml | 21 ++++----
 ...up_discovery_with_script_block_logging.yml | 23 +++++----
 ..._memory_via_system_reflection_assembly.yml | 23 ++++-----
 .../powershell_processing_stream_of_data.yml  | 23 ++++-----
 ...hell_remove_windows_defender_directory.yml | 22 +++++----
 ...wershell_using_memory_as_backing_store.yml | 24 ++++-----
 ...ll_windows_defender_exclusion_commands.yml | 25 +++++-----
 .../recon_avproduct_through_pwh_or_wmi.yml    | 23 ++++-----
 detections/endpoint/recon_using_wmi_class.yml | 28 ++++++-----
 ...n_via_dcom_and_powershell_script_block.yml | 21 ++++----
 ..._via_winrm_and_powershell_script_block.yml | 23 +++++----
 ...on_via_wmi_and_powershell_script_block.yml | 18 ++++---
 ...ote_system_discovery_with_adsisearcher.yml | 12 ++---
 ...incipalnames_discovery_with_powershell.yml |  4 +-
 .../unloading_amsi_via_reflection.yml         | 16 +++---
 ..._with_env_vars_powershell_script_block.yml | 12 ++---
 .../wmi_recon_running_process_or_services.yml | 16 +++---
 .../exchange_powershell_module_usage.yml      | 22 +++++----
 59 files changed, 678 insertions(+), 541 deletions(-)

diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml
index 44c73e3766..700b4bb272 100644
--- a/detections/endpoint/adsisearcher_account_discovery.yml
+++ b/detections/endpoint/adsisearcher_account_discovery.yml
@@ -1,7 +1,7 @@
 name: AdsiSearcher Account Discovery
 id: de7fcadc-04f3-11ec-a241-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -9,9 +9,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
   domain users for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*"
-  Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
-  by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*"
+  ScriptBlockText = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
+  by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `adsisearcher_account_discovery_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -21,9 +21,11 @@ references:
 - https://attack.mitre.org/techniques/T1087/002/
 - https://www.blackhillsinfosec.com/red-blue-purple/
 - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -34,16 +36,17 @@ tags:
   impact: 50
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ for user enumeration
+  message: PowerShell process having command-line $ScriptBlockText$ for user enumeration
   mitre_attack_id:
   - T1087.002
   - T1087
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -54,8 +57,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
index 644a57103f..a9bf409bb2 100644
--- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
+++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
@@ -1,7 +1,7 @@
 name: Allow Inbound Traffic In Firewall Rule
 id: a5d85486-b89c-11eb-8267-acde48001122
-version: 1
-date: '2021-05-19'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -10,9 +10,9 @@ description: The following analytic identifies suspicious PowerShell command to
   inbound traffic inbound to a specific local port within the public profile. This
   technique was seen in some attacker want to have a remote access to a machine by
   allowing the traffic in firewall rule.
-search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Inbound*"
-  Message = "*Allow*"  Message = "*-LocalPort*" | stats count min(_time) as firstTime
-  max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*firewall*" ScriptBlockText = "*Inbound*"
+  ScriptBlockText = "*Allow*"  ScriptBlockText = "*-LocalPort*" | stats count min(_time) as firstTime
+  max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the powershell logs  from your endpoints. make sure you enable needed
@@ -21,9 +21,11 @@ known_false_positives: administrator may allow inbound traffic in certain networ
   or machine.
 references:
 - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 30
   context:
@@ -34,17 +36,18 @@ tags:
   impact: 10
   kill_chain_phases:
   - Exploitation
-  message: Suspicious firewall modification detected on endpoint $ComputerName$ by
-    user $user$.
+  message: Suspicious firewall modification detected on endpoint $Computer$ by
+    user $UserID$.
   mitre_attack_id:
   - T1021.001
   - T1021
+  - T1059.001
   observable:
-  - name: user
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -55,8 +58,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 3
   security_domain: endpoint
diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index 7349f7bf96..933823423a 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Delete ShadowCopy With PowerShell
 id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
-version: 1
-date: '2021-05-12'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,9 +11,9 @@ description: This following analytic detects PowerShell command to delete shadow
   to deploy DarkSide Ransomware where it executed a child process of PowerShell to
   execute a hex encoded command to delete shadow copy. This hex encoded command was
   able to be decrypted by PowerShell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*"
-  OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
-  by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*"
+  OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
+  by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `delete_shadowcopy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the powershell logs  from your endpoints. make sure you enable needed
@@ -22,11 +22,13 @@ known_false_positives: unknown
 references:
 - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
 - https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - DarkSide Ransomware
   - Ransomware
   - Revil Ransomware
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 90
   context:
@@ -37,16 +39,17 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$
-    by $User$.
+  message: An attempt to delete ShadowCopy was performed using PowerShell on $Computer$
+    by $UserID$.
   mitre_attack_id:
   - T1490
+  - T1059.001
   observable:
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -57,8 +60,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index e7285779a9..d1e7cb247c 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -1,7 +1,7 @@
 name: Detect Copy of ShadowCopy with Script Block Logging
 id: 9251299c-ea5b-11eb-a8de-acde48001122
-version: 1
-date: '2021-07-21'
+version: 2
+date: '2022-02-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -18,10 +18,10 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*")
-  AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
-  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*copy*","*[System.IO.File]::Copy*")
+  AND ScriptBlockText IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -32,9 +32,11 @@ references:
 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934
 - https://github.com/GossiTheDog/HiveNightmare
 - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Credential Dumping
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -48,16 +50,17 @@ tags:
   kill_chain_phases:
   - Exploitation
   message: PowerShell was identified running a script to capture the SAM hive on endpoint
-    $ComputerName$ by user $user$.
+    $Computer$ by User $UserID$.
   mitre_attack_id:
   - T1003.002
   - T1003
+  - T1059.001
   observable:
-  - name: user
-    type: User
+  - name: UserID
+    type: user
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -67,10 +70,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserIDID
   - EventCode
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
index 8bb5dffc0e..0d4ef85e91 100644
--- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
@@ -1,7 +1,7 @@
 name: Detect Empire with PowerShell Script Block Logging
 id: bc1dc6b8-c954-11eb-bade-acde48001122
-version: 1
-date: '2021-06-09'
+version: 2
+date: '2022-02-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -19,9 +19,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104  (Message=*system.net.webclient* AND Message=*frombase64string*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
-  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104  (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_empire_with_powershell_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -35,6 +35,7 @@ references:
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
 - https://github.com/BC-SECURITY/Empire
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -49,16 +50,16 @@ tags:
   kill_chain_phases:
   - Exploitation
   message: The following behavior was identified and typically related to PowerShell-Empire
-    on $ComputerName$ by $User$.
+    on $Computer$ by $UserID$.
   mitre_attack_id:
   - T1059
   - T1059.001
   observable:
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -68,10 +69,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserIDID
   - EventCode
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
index 543d762e98..39a419d35b 100644
--- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -1,7 +1,7 @@
 name: Detect Mimikatz With PowerShell Script Block Logging
 id: 8148c29c-c952-11eb-9255-acde48001122
-version: 1
-date: '2021-06-09'
+version: 2
+date: '2022-02-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -18,9 +18,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
+search: '`powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
   *kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time)
-  as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
+  as lastTime by OpCode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -32,6 +32,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -46,15 +47,16 @@ tags:
   kill_chain_phases:
   - Exploitation
   message: The following behavior was identified and typically related to MimiKatz
-    being loaded within the context of PowerShell on $ComputerName$ by $User$.
+    being loaded within the context of PowerShell on $Computer$ by $UserID$.
   mitre_attack_id:
   - T1003
+  - T1059.001
   observable:
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -64,10 +66,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserIDID
   - EventCode
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
index 27ee132288..949c490c86 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
@@ -1,7 +1,7 @@
 name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
 id: 114c6bfe-9406-11ec-bcce-acde48001122
-version: 1
-date: '2022-02-22'
+version: 2
+date: '2022-02-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -11,8 +11,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser 
   allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
   Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
-search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -22,9 +22,11 @@ references:
 - https://attack.mitre.org/techniques/T1558/004/
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  - Malicious PowerShell
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
   kill_chain_phases:
@@ -32,6 +34,7 @@ tags:
   mitre_attack_id:
   - T1558
   - T1558.004
+  - T1059.001
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -48,9 +51,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   security_domain: endpoint
   impact: 60
   confidence: 90 
@@ -59,4 +62,4 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$
\ No newline at end of file
+  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$.
\ No newline at end of file
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index 37adc01659..2f84559451 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -1,7 +1,7 @@
 name: Disabled Kerberos Pre-Authentication Discovery With PowerView
 id: b0b34e2c-90de-11ec-baeb-acde48001122
-version: 1
-date: '2022-02-18'
+version: 2
+date: '2022-02-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -11,8 +11,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired`
   allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
   Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
-search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -22,9 +22,11 @@ references:
 - https://attack.mitre.org/techniques/T1558/004/
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  - Malicious PowerShell
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
   kill_chain_phases:
@@ -32,6 +34,7 @@ tags:
   mitre_attack_id:
   - T1558
   - T1558.004
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -44,9 +47,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   security_domain: endpoint
   impact: 60
   confidence: 90 
diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
index 202cb361d1..f55463cc1b 100644
--- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
@@ -1,7 +1,7 @@
 name: Domain Group Discovery with Adsisearcher
 id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7
-version: 1
-date: '2021-08-25'
+version: 2
+date: '2022-02-24'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -9,9 +9,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
   domain groups for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*"
-  AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
-  lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*(objectcategory=group)*"
+  AND ScriptBlockText = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
+  lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `domain_group_discovery_with_adsisearcher_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -20,9 +20,11 @@ known_false_positives: Administrators or power users may use Adsisearcher for tr
 references:
 - https://attack.mitre.org/techniques/T1069/002/
 - https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 60
   context:
@@ -34,10 +36,11 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
+  message: Domain group discovery enumeration using PowerShell on $dest$ by $UserID$
   mitre_attack_id:
   - T1069
   - T1069.002
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -50,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 18
   security_domain: endpoint
diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml
index 8a9f22a77d..a58d445604 100644
--- a/detections/endpoint/elevated_group_discovery_with_powerview.yml
+++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml
@@ -1,7 +1,7 @@
 name: Elevated Group Discovery with PowerView
 id: 10d62950-0de5-4199-a710-cff9ea79b413
-version: 1
-date: '2021-08-25'
+version: 2
+date: '2022-02-24'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -12,10 +12,10 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   specific domain group. Red Teams and adversaries alike use PowerView to enumerate
   elevated domain groups for situational awareness and Active Directory Discovery
   to identify high privileged users.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroupMember*") AND ScriptBlockText
   IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*"
   , "*Server Operators*", "*Protected Users*",  "*Dns Admins*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `elevated_group_discovery_with_powerview_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -26,9 +26,11 @@ references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/
 - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory
 - https://attack.mitre.org/techniques/T1069/002/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 70
   context:
@@ -44,6 +46,7 @@ tags:
   mitre_attack_id:
   - T1069
   - T1069.002
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -56,8 +59,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 21
   security_domain: endpoint
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
index b41274ac38..6aef53f7cd 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Get ADDefaultDomainPasswordPolicy with Powershell
 id: 36e46ebe-065a-11ec-b4c7-acde48001122
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Splunk
 type: Hunting
 datamodel:
@@ -11,8 +11,7 @@ description: This analytic looks for the execution of `powershell.exe` executing
   in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate
   domain policies for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
-  OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR `process_powershell` AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -29,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 30
   context:
@@ -42,6 +42,7 @@ tags:
   message: an instance of process $process_name$ with commandline $process$ in $dest$
   mitre_attack_id:
   - T1201
+  - T1059.001
   observable:
   - name: user
     type: User
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
index f165a51153..aeb8111cb5 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
 id: 1ff7ccc8-065a-11ec-91e4-acde48001122
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   used to obtain the password policy in a Windows domain. Red Teams and adversaries
   alike may use PowerShell to enumerate domain policies for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-ADDefaultDomainPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -22,9 +22,11 @@ references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
 - https://attack.mitre.org/techniques/T1201/
 - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 30
   context:
@@ -39,12 +41,13 @@ tags:
     policy
   mitre_attack_id:
   - T1201
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -55,8 +58,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml
index b9c271f9a2..ca88ec4e7a 100644
--- a/detections/endpoint/get_aduser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml
@@ -1,18 +1,18 @@
 name: Get ADUser with PowerShell Script Block
 id: 21432e40-04f4-11ec-b7e6-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet
+  to identify the execution of the `Get-AdUser` commandlet. The `Get-AdUser` commandlet
   is used to return a list of all domain users. Red Teams and adversaries may leverage
   this commandlet to enumerate domain groups for situational awareness and Active
   Directory Discovery.
-search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-aduser*" ScriptBlockText = "*-filter*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduser_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -22,9 +22,11 @@ references:
 - https://www.blackhillsinfosec.com/red-blue-purple/
 - https://attack.mitre.org/techniques/T1087/002/
 - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -39,12 +41,13 @@ tags:
   mitre_attack_id:
   - T1087.002
   - T1087
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -55,8 +58,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
index a465b42fa2..48a01826b8 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get ADUserResultantPasswordPolicy with Powershell Script Block
 id: 737e1eb0-065a-11ec-921a-acde48001122
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, MAuricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   used to obtain the password policy in a Windows domain. Red Teams and adversaries
   alike may use PowerShell to enumerate domain policies for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-ADUserResultantPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -22,9 +22,11 @@ references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
 - https://attack.mitre.org/techniques/T1201/
 - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 30
   context:
@@ -35,16 +37,17 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ to query domain user password
+  message: powershell process having commandline $ScriptBlockText$ to query domain user password
     policy.
   mitre_attack_id:
   - T1201
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -55,8 +58,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml
index a47bfa8f2e..33066e66d2 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Get DomainPolicy with Powershell
 id: b8f9947e-065a-11ec-aafb-acde48001122
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel:
@@ -11,8 +11,7 @@ description: This analytic looks for the execution of `powershell.exe` executing
   Red Teams and adversaries alike may use PowerShell to enumerate domain policies
   for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
-  OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*"
+  as lastTime from datamodel=Endpoint.Processes where `process_cmd` OR `process_powershell` AND Processes.process = "*Get-DomainPolicy*"
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
@@ -29,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 60
   context:
@@ -42,6 +42,7 @@ tags:
   message: an instance of process $process_name$ with commandline $process$ in $dest$
   mitre_attack_id:
   - T1201
+  - T1059.001
   observable:
   - name: user
     type: User
diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index 0e2c27fac2..3e203c868d 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get DomainPolicy with Powershell Script Block
 id: a360d2b2-065a-11ec-b0bf-acde48001122
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -9,8 +9,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the execution of the `Get DomainPolicy` commandlet used to obtain the
   password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell
   to enumerate domain policies for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -20,9 +20,11 @@ references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/
 - https://attack.mitre.org/techniques/T1201/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 60
   context:
@@ -33,11 +35,12 @@ tags:
   impact: 50
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ to query domain policy.
+  message: powershell process having commandline $ScriptBlockText$ to query domain policy.
   mitre_attack_id:
   - T1201
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -52,8 +55,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 30
   security_domain: endpoint
diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index 8ad1cbdf75..deb8c2f203 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get-DomainTrust with PowerShell Script Block
 id: 89275e7e-0548-11ec-bf75-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-02-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -17,8 +17,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by ScriptBlockText Computer UserID EventCode | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -31,9 +31,11 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 40
   context:
@@ -44,16 +46,17 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$
-    by user $user$.
+  message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$
+    by user $UserID$.
   mitre_attack_id:
   - T1482
+  - T1059.001
   observable:
-  - name: user
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -68,10 +71,10 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
+  - ScriptBlockText
   - Path
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserIDID
   risk_score: 12
   security_domain: endpoint
diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
index 9836eea84e..6426d64e2e 100644
--- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get DomainUser with PowerShell Script Block
 id: 61994268-04f4-11ec-865c-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-02-24'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
   Red Teams and adversaries alike may use PowerView to enumerate domain users for
   situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainUser*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -19,9 +19,11 @@ how_to_implement: The following Hunting analytic requires PowerShell operational
 known_false_positives: Administrators or power users may use this command for troubleshooting.
 references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -32,17 +34,18 @@ tags:
   impact: 50
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ for user enumeration
+  message: powershell process having commandline $ScriptBlockText$ for user enumeration
   mitre_attack_id:
   - T1087.002
   - T1087
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
-    type: User
+  - name: UserID
+    type: user
     role:
     - Victim
   product:
@@ -52,8 +55,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
index d04a74656a..5f5888717c 100644
--- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get-ForestTrust with PowerShell Script Block
 id: 70fac80e-0bf1-11ec-9ba0-acde48001122
-version: 1
-date: '2021-09-02'
+version: 2
+date: '2022-02-24'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -17,15 +17,16 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by  Message OpCode ComputerName User EventCode
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by ScriptBlockText OpCode Computer UserID EventCode
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES
+known_false_positives: False positives should be limited as this is a PowerSploit module. Filter as needed.
 references:
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-ForestTrust/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
@@ -39,16 +40,17 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $ComputerName$
-    by user $User$.
+  message: Suspicious PowerShell Get-ForestTrust was identified on endpoint $Computer$
+    by user $UserID$.
   mitre_attack_id:
   - T1482
+  - T1059.001
   observable:
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -59,10 +61,10 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
+  - ScriptBlockText
   - Path
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserIDID
   risk_score: 12
   security_domain: endpoint
diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
index c234f36c5e..d26c7ba61c 100644
--- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
@@ -1,7 +1,7 @@
 name: Get WMIObject Group Discovery with Script Block Logging
 id: 69df7f7c-155d-11ec-a055-acde48001122
-version: 1
-date: '2021-09-14'
+version: 2
+date: '2022-02-25'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel: []
@@ -18,9 +18,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*Get-WMIObject*" AND Message = "*Win32_Group*"
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText = "*Win32_Group*"
   | stats count min(_time) as firstTime max(_time) as lastTime by  Message OpCode
-  ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  Computer UserID EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_wmiobject_group_discovery_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -33,9 +33,11 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -47,16 +49,17 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: System group discovery enumeration on $dest$ by $user$.
+  message: System group discovery enumeration on $dest$ by $UserID$.
   mitre_attack_id:
   - T1069
   - T1069.001
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
     role:
     - Victim
-  - name: user
+  - name: UserID
     type: User
     role:
     - Victim
@@ -67,8 +70,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
index f38cf2f2a9..9a3eb2e7fb 100644
--- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetAdComputer with PowerShell Script Block
 id: a9a1da02-8e27-4bf7-a348-f4389c9da487
-version: 1
-date: '2021-09-01'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is used to return a list of all domain computers. Red Teams and adversaries may
   leverage this commandlet to enumerate domain computers for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
   User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -21,9 +21,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
 references:
 - https://attack.mitre.org/techniques/T1018/
 - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -35,9 +37,10 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: Remote system discovery enumeration on $dest$ by $UserID$
   mitre_attack_id:
   - T1018
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -50,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml
index 7c1119fa15..3bcde3b136 100644
--- a/detections/endpoint/getadgroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetAdGroup with PowerShell Script Block
 id: e4c73d68-794b-468d-b4d0-dac1772bbae7
-version: 1
-date: '2021-08-25'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is used to return a list of all domain groups. Red Teams and adversaries may leverage
   this commandlet to enumerate domain groups for situational awareness and Active
   Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-ADGroup*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `getadgroup_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -21,9 +21,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
 references:
 - https://attack.mitre.org/techniques/T1069/002/
 - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -35,7 +37,7 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
+  message: Domain group discovery enumeration using PowerShell on $dest$ by $UserID$
   mitre_attack_id:
   - T1069
   - T1069.002
@@ -51,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index d1892d1e2a..dd916434b7 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetCurrent User with PowerShell Script Block
 id: 80879283-c30f-44f7-8471-d1381f6d437a
-version: 1
-date: '2021-09-13'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   class. This method returns an object that represents the current Windows user. Red
   Teams and adversaries may leverage this method to identify the logged user on a
   compromised endpoint for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*"
-  AND Message = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*"
+  AND ScriptBlockText = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `getcurrent_user_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -22,9 +22,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
 references:
 - https://attack.mitre.org/techniques/T1033/
 - https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -39,6 +41,7 @@ tags:
   message: System user discovery on $dest$
   mitre_attack_id:
   - T1033
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -51,10 +54,10 @@ tags:
   required_fields:
   - _time
   - Path
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserIDID
   - EventCode
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
index 67a9791ec1..3394df1372 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetDomainComputer with PowerShell Script Block
 id: f64da023-b988-4775-8d57-38e512beb56e
-version: 1
-date: '2021-09-02'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
   Red Teams and adversaries alike may use PowerView to enumerate domain computers
   for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
+  UserID | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -23,6 +23,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 80
   context:
@@ -34,9 +35,10 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery with PowerView on $dest$ by $user$
+  message: Remote system discovery with PowerView on $dest$ by $UserID$
   mitre_attack_id:
   - T1018
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -49,8 +51,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 24
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
index 92f51f5444..136c6006d6 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetDomainController with PowerShell Script Block
 id: 676b600a-a94d-4951-b346-11329431e6c1
-version: 1
-date: '2021-09-02'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
   Red Teams and adversaries alike may use PowerView to enumerate domain computers
   for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
   User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -21,9 +21,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
 references:
 - https://attack.mitre.org/techniques/T1018/
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainController/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 80
   context:
@@ -35,9 +37,10 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery with PowerView on $dest$ by $user$
+  message: Remote system discovery with PowerView on $dest$ by $UserID$
   mitre_attack_id:
   - T1018
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -50,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserIDID
   risk_score: 24
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
index 6cac522789..b3b2e9c04f 100644
--- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetDomainGroup with PowerShell Script Block
 id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -11,9 +11,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams
   and adversaries may leverage this function to enumerate domain groups for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
+  UserID | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -22,9 +22,11 @@ known_false_positives: Administrators or power users may use this PowerView func
 references:
 - https://attack.mitre.org/techniques/T1069/002/
 - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -40,6 +42,7 @@ tags:
   mitre_attack_id:
   - T1069
   - T1069.002
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -52,8 +55,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
index ee832bdb05..8bbf5e022a 100644
--- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml
+++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetLocalUser with PowerShell Script Block
 id: 2e891cbe-0426-11ec-9c9c-acde48001122
-version: 1
-date: '2021-08-23'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   commandlet is used to return a list of all local users. Red Teams and adversaries
   may leverage this commandlet to enumerate users for situational awareness and Active
   Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-LocalUser*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-LocalUser*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `getlocaluser_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -20,9 +20,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
   for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1087/001/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   confidence: 50
   context:
   - Source:Endpoint
@@ -37,6 +39,7 @@ tags:
   mitre_attack_id:
   - T1087
   - T1087.001
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -48,5 +51,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode 
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
index 3444f85812..9f2e47dde3 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetNetTcpconnection with PowerShell Script Block
 id: 091712ff-b02a-4d43-82ed-34765515d95d
-version: 1
-date: '2021-09-10'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is used to return a listing of network connections on a compromised system. Red
   Teams and adversaries alike may use this commandlet for situational awareness and
   Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
+  UserID | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -21,9 +21,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
 references:
 - https://attack.mitre.org/techniques/T1049/
 - https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=windowsserver2019-ps
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -38,6 +40,7 @@ tags:
   message: Network Connection discovery on $dest$ by $user$
   mitre_attack_id:
   - T1049
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -50,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
index 9c632db1d6..e37bcb077c 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetWmiObject Ds Computer with PowerShell Script Block
 id: 29b99201-723c-4118-847a-db2b3d3fb8ea
-version: 1
-date: '2021-09-01'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   parameter leverages WMI to query for all domain computers. Red Teams and adversaries
   may leverage this commandlet to enumerate domain computers for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
-  root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace
+  root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_computer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -22,9 +22,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
 references:
 - https://attack.mitre.org/techniques/T1018/
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -39,6 +41,7 @@ tags:
   message: Remote system discovery enumeration on $dest$ by $user$
   mitre_attack_id:
   - T1018
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -51,8 +54,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
index 2d3d5d7a09..15f7408716 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
@@ -1,6 +1,6 @@
 name: GetWmiObject Ds Group with PowerShell Script Block
 id: 67740bd3-1506-469c-b91d-effc322cc6e5
-version: 1
+version: 2
 date: '2021-08-25'
 author: Mauricio Velazco, Splunk
 type: TTP
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
   and adversaries may leverage this commandlet to enumerate domain groups for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
-  root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace
+  root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_group_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -22,9 +22,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
 references:
 - https://attack.mitre.org/techniques/T1069/002/
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -40,6 +42,7 @@ tags:
   mitre_attack_id:
   - T1069
   - T1069.002
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -52,8 +55,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
index b37def5d6a..4cd2f23a3f 100644
--- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetWmiObject DS User with PowerShell Script Block
 id: fabd364e-04f3-11ec-b34b-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   parameter leverages WMI to query for all domain users. Red Teams and adversaries
   may leverage this commandlet to enumerate domain users for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*"
-  Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*"
+  ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
 how_to_implement: he following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -21,9 +21,11 @@ known_false_positives: Administrators or power users may use this command for tr
 references:
 - https://www.blackhillsinfosec.com/red-blue-purple/
 - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -38,8 +40,9 @@ tags:
   mitre_attack_id:
   - T1087.002
   - T1087
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -54,8 +57,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index 10779deb4b..dbe970d57e 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   The `Win32_UserAccount` parameter is used to return a list of all local users. Red
   Teams and adversaries may leverage this commandlet to enumerate users for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Get-WmiObject*" AND ScriptBlockText="*Win32_UserAccount*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  Computer UserID | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -20,9 +20,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
   for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1087/001/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   confidence: 50
   context:
   - Source:Endpoint
@@ -37,6 +39,7 @@ tags:
   mitre_attack_id:
   - T1087
   - T1087.001
+  - T1059.001
   observable:
   - name: dest
     type: Endpoint
@@ -48,5 +51,9 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
index 40bdb14ab8..06b6d9265a 100644
--- a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
+++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Interactive Session on Remote Endpoint with PowerShell
 id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af
-version: 2
-date: '2022-02-18'
+version: 3
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,8 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams
   and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement
   and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Enter-PSSession*" AND ScriptBlockText="*-Computer*") 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
   | `security_content_ctime(firstTime)` 
   | `interactive_session_on_remote_endpoint_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -26,6 +26,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Malicious PowerShell
   confidence: 50
   context:
   - Source:Endpoint
@@ -35,12 +36,13 @@ tags:
   impact: 90
   kill_chain_phases:
   - Lateral Movement
-  message: An interactive session was opened on a remote endpoint from $ComputerName
+  message: An interactive session was opened on a remote endpoint from $Computer$
   mitre_attack_id:
   - T1021
   - T1021.006
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -51,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 45
   security_domain: endpoint
diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
index 18446fda3a..90b5e5199c 100644
--- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
+++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Kerberos Pre-Authentication Flag Disabled with PowerShell
 id: 59b51620-94c9-11ec-b3d5-acde48001122
-version: 1
-date: '2022-02-23'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -13,8 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to easily perform a brute force attack against the user's password offline leveraging the ASP REP Roasting technique.
   Red Teams and adversaries alike who have obtained privileges in an Active Directory network may use this technique as a backdoor 
   or a way to escalate privileges.
-search: ' `powershell` EventCode=4104 (Message = "*Set-ADAccountControl*" AND Message="*DoesNotRequirePreAuth:$true*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Set-ADAccountControl*" AND ScriptBlockText="*DoesNotRequirePreAuth:$true*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `kerberos_pre_authentication_flag_disabled_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -24,9 +24,11 @@ references:
 - https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties 
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Kerberos Attacks
+  - Malicious PowerShell
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log
   kill_chain_phases:
@@ -41,6 +43,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - EventCode
+  - ScriptBlockText
+  - Computer
+  - UserID
   security_domain: endpoint
   impact: 50
   confidence: 90 
@@ -49,9 +55,9 @@ tags:
   - Source:Endpoint
   - Stage:PrivilegeEscalation
   - Stage:Persistence
-  message: Kerberos Pre Authentication was Disabled using PowerShell on $dest$
+  message: Kerberos Pre Authentication was Disabled using PowerShell on $Computer$
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
\ No newline at end of file
diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml
index 028bb99c8b..88cd4eb6f4 100644
--- a/detections/endpoint/mailsniper_invoke_functions.yml
+++ b/detections/endpoint/mailsniper_invoke_functions.yml
@@ -1,7 +1,7 @@
 name: Mailsniper Invoke functions
 id: a36972c8-b894-11eb-9f78-acde48001122
-version: 1
-date: '2021-05-19'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -9,12 +9,12 @@ datamodel:
 description: This search is to detect known mailsniper.ps1 functions executed in a
   machine. This technique was seen in some attacker to harvest some sensitive e-mail
   in a compromised exchange server.
-search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*",
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*",
   "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*",
   "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*",
   "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `mailsniper_invoke_functions_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the powershell logs  from your endpoints. make sure you enable needed
@@ -22,9 +22,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: unknown
 references:
 - https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Data Exfiltration
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 80
   context:
@@ -35,13 +37,14 @@ tags:
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user
+  message: mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user
     $user$.
   mitre_attack_id:
   - T1114
   - T1114.001
+  - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -56,8 +59,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 72
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index ee4bb6d61a..322f6fdc58 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -1,7 +1,7 @@
 name: PowerShell 4104 Hunting
 id: d6f2b006-0041-11ec-8885-acde48001122
-version: 1
-date: '2021-08-18'
+version: 2
+date: '2022-02-25'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel: []
@@ -10,26 +10,26 @@ description: The following Hunting analytic assists with identifying suspicious
   to be ran hourly, but occasionally to identify malicious or suspicious PowerShell.
   This analytic is a combination of work completed by Alex Teixeira and Splunk Threat
   Research Team.
-search: '`powershell` EventCode=4104 | eval DoIt = if(match(Message,"(?i)(\$doit)"),
-  "4", 0) | eval enccom=if(match(Message,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
-  OR match(Message, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(Message,
+search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"),
+  "4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)")
+  OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(ScriptBlockText,
   "(?i)Add-Exfiltration|Add-Persistence|Add-RegBackdoor|Add-ScrnSaveBackdoor|Check-VM|Do-Exfiltration|Enabled-DuplicateToken|Exploit-Jboss|Find-Fruit|Find-GPOLocation|Find-TrustedDocuments|Get-ApplicationHost|Get-ChromeDump|Get-ClipboardContents|Get-FoxDump|Get-GPPPassword|Get-IndexedItem|Get-Keystrokes|LSASecret|Get-PassHash|Get-RegAlwaysInstallElevated|Get-RegAutoLogon|Get-RickAstley|Get-Screenshot|Get-SecurityPackages|Get-ServiceFilePermission|Get-ServicePermission|Get-ServiceUnquoted|Get-SiteListPassword|Get-System|Get-TimedScreenshot|Get-UnattendedInstallFile|Get-Unconstrained|Get-VaultCredential|Get-VulnAutoRun|Get-VulnSchTask|Gupt-Backdoor|HTTP-Login|Install-SSP|Install-ServiceBinary|Invoke-ACLScanner|Invoke-ADSBackdoor|Invoke-ARPScan|Invoke-AllChecks|Invoke-BackdoorLNK|Invoke-BypassUAC|Invoke-CredentialInjection|Invoke-DCSync|Invoke-DllInjection|Invoke-DowngradeAccount|Invoke-EgressCheck|Invoke-Inveigh|Invoke-InveighRelay|Invoke-Mimikittenz|Invoke-NetRipper|Invoke-NinjaCopy|Invoke-PSInject|Invoke-Paranoia|Invoke-PortScan|Invoke-PoshRat|Invoke-PostExfil|Invoke-PowerDump|Invoke-PowerShellTCP|Invoke-PsExec|Invoke-PsUaCme|Invoke-ReflectivePEInjection|Invoke-ReverseDNSLookup|Invoke-RunAs|Invoke-SMBScanner|Invoke-SSHCommand|Invoke-Service|Invoke-Shellcode|Invoke-Tater|Invoke-ThunderStruck|Invoke-Token|Invoke-UserHunter|Invoke-VoiceTroll|Invoke-WScriptBypassUAC|Invoke-WinEnum|MailRaider|New-HoneyHash|Out-Minidump|Port-Scan|PowerBreach|PowerUp|PowerView|Remove-Update|Set-MacAttribute|Set-Wallpaper|Show-TargetScreen|Start-CaptureServer|VolumeShadowCopyTools|NEEEEWWW|(Computer|User)Property|CachedRDPConnection|get-net\S+|invoke-\S+hunter|Install-Service|get-\S+(credent|password)|remoteps|Kerberos.*(policy|ticket)|netfirewall|Uninstall-Windows|Verb\s+Runas|AmsiBypass|nishang|Invoke-Interceptor|EXEonRemote|NetworkRelay|PowerShelludp|PowerShellIcmp|CreateShortcut|copy-vss|invoke-dll|invoke-mass|out-shortcut|Invoke-ShellCommand"),1,0)
-  | eval base64 = if(match(lower(Message),"frombase64"), "4", 0) | eval empire=if(match(lower(Message),"system.net.webclient")
-  AND match(lower(Message), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(Message),"mimikatz")
-  OR match(lower(Message), "-dumpcr") OR match(lower(Message), "SEKURLSA::Pth") OR
-  match(lower(Message), "kerberos::ptt") OR match(lower(Message), "kerberos::golden")
-  ,5,0) | eval iex = if(match(lower(Message),"iex"), "2", 0) | eval webclient=if(match(lower(Message),"http")
-  OR match(lower(Message),"web(client|request)") OR match(lower(Message),"socket")
-  OR match(lower(Message),"download(file|string)") OR match(lower(Message),"bitstransfer")
-  OR match(lower(Message),"internetexplorer.application") OR match(lower(Message),"xmlhttp"),5,0)
-  | eval get = if(match(lower(Message),"get-"), "1", 0) | eval rundll32 = if(match(lower(Message),"rundll32"),
-  "4", 0) | eval suspkeywrd=if(match(Message, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0)
-  | eval syswow64 = if(match(lower(Message),"syswow64"), "3", 0) | eval httplocal
-  = if(match(lower(Message),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(Message),"reflection"),
-  "1", 0) | eval invokewmi=if(match(lower(Message), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0)
-  | eval downgrade=if(match(Message, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(Message),"powershell
-  -version"),3,0) | eval compressed=if(match(Message, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0)
-  | eval invokecmd = if(match(lower(Message),"invoke-command"), "4", 0) | addtotals
+  | eval base64 = if(match(lower(ScriptBlockText),"frombase64"), "4", 0) | eval empire=if(match(lower(ScriptBlockText),"system.net.webclient")
+  AND match(lower(ScriptBlockText), "frombase64string") ,5,0) | eval mimikatz=if(match(lower(ScriptBlockText),"mimikatz")
+  OR match(lower(ScriptBlockText), "-dumpcr") OR match(lower(ScriptBlockText), "SEKURLSA::Pth") OR
+  match(lower(ScriptBlockText), "kerberos::ptt") OR match(lower(ScriptBlockText), "kerberos::golden")
+  ,5,0) | eval iex = if(match(lower(ScriptBlockText),"iex"), "2", 0) | eval webclient=if(match(lower(ScriptBlockText),"http")
+  OR match(lower(ScriptBlockText),"web(client|request)") OR match(lower(ScriptBlockText),"socket")
+  OR match(lower(ScriptBlockText),"download(file|string)") OR match(lower(ScriptBlockText),"bitstransfer")
+  OR match(lower(ScriptBlockText),"internetexplorer.application") OR match(lower(ScriptBlockText),"xmlhttp"),5,0)
+  | eval get = if(match(lower(ScriptBlockText),"get-"), "1", 0) | eval rundll32 = if(match(lower(ScriptBlockText),"rundll32"),
+  "4", 0) | eval suspkeywrd=if(match(ScriptBlockText, "(?i)(bitstransfer|mimik|metasp|AssemblyBuilderAccess|Reflection\.Assembly|shellcode|injection|cnvert|shell\.application|start-process|Rc4ByteStream|System\.Security\.Cryptography|lsass\.exe|localadmin|LastLoggedOn|hijack|BackupPrivilege|ngrok|comsvcs|backdoor|brute.?force|Port.?Scan|Exfiltration|exploit|DisableRealtimeMonitoring|beacon)"),1,0)
+  | eval syswow64 = if(match(lower(ScriptBlockText),"syswow64"), "3", 0) | eval httplocal
+  = if(match(lower(ScriptBlockText),"http://127.0.0.1"), "4", 0) | eval reflection = if(match(lower(ScriptBlockText),"reflection"),
+  "1", 0) | eval invokewmi=if(match(lower(ScriptBlockText), "(?i)(wmiobject|WMIMethod|RemoteWMI|PowerShellWmi|wmicommand)"),5,0)
+  | eval downgrade=if(match(ScriptBlockText, "(?i)([-]ve*r*s*i*o*n*\s+2)") OR match(lower(ScriptBlockText),"powershell
+  -version"),3,0) | eval compressed=if(match(ScriptBlockText, "(?i)GZipStream|::Decompress|IO.Compression|write-zip|(expand|compress)-Archive"),5,0)
+  | eval invokecmd = if(match(lower(ScriptBlockText),"invoke-command"), "4", 0) | addtotals
   fieldname=Score DoIt, enccom, suspcmdlet, suspkeywrd, compressed, downgrade, mimikatz,
   iex, empire, rundll32, webclient, syswow64, httplocal, reflection, invokewmi, invokecmd,
   base64, get | stats values(Score) by DoIt, enccom, compressed, downgrade, iex, mimikatz,
@@ -47,6 +47,7 @@ references:
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging?view=powershell-5.1
 - https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html
 - https://hurricanelabs.com/splunk-tutorials/how-to-use-powershell-transcription-logs-in-splunk/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -64,11 +65,11 @@ tags:
   - T1059
   - T1059.001
   observable:
-  - name: user
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: dest
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -86,6 +87,6 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml
index 0602742c85..45baff2f70 100644
--- a/detections/endpoint/powershell_creating_thread_mutex.yml
+++ b/detections/endpoint/powershell_creating_thread_mutex.yml
@@ -1,7 +1,7 @@
 name: Powershell Creating Thread Mutex
 id: 637557ec-ca08-11eb-bd0a-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -11,8 +11,8 @@ description: The following analytic identifies suspicious PowerShell script exec
   there process is running on a compromise machine. During triage, review parallel
   processes within the same timeframe. Review the full script block to identify other
   related artifacts.
-search: '`powershell` EventCode=4104 Message = "*Threading.Mutex*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Threading.Mutex*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `powershell_creating_thread_mutex_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -38,17 +38,18 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains Thread Mutex in $Message$ with
-    EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains Thread Mutex in $ScriptBlockText$ with
+    EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1027
   - T1027.005
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -59,8 +60,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 40
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml
index 4021aed5c3..9b31b065b8 100644
--- a/detections/endpoint/powershell_domain_enumeration.yml
+++ b/detections/endpoint/powershell_domain_enumeration.yml
@@ -1,7 +1,7 @@
 name: PowerShell Domain Enumeration
 id: e1866ce2-ca22-11eb-8e44-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-02-25'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -17,9 +17,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN (*get-netdomaintrust*, *get-netforesttrust*,
+search: '`powershell` EventCode=4104 ScriptBlockText IN (*get-netdomaintrust*, *get-netforesttrust*,
   *get-addomain*, *get-adgroupmember*, *get-domainuser*) | stats count min(_time)
-  as firstTime max(_time) as lastTime by ComputerName EventCode Message | `security_content_ctime(firstTime)`
+  as firstTime max(_time) as lastTime by Computer EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `powershell_domain_enumeration_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,6 +30,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -43,13 +44,13 @@ tags:
   impact: 60
   kill_chain_phases:
   - Reconnaissance
-  message: A suspicious powershell script contains domain enumeration command in $Message$
-    with EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains domain enumeration command in $ScriptBlockText$
+    with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059
   - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -63,8 +64,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
-  - ComputerName
+  - ScriptBlockText
+  - Computer
   - EventCode
   risk_score: 42
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
index e75d2001d3..a07eb69f15 100644
--- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml
+++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
@@ -1,7 +1,7 @@
 name: Powershell Enable SMB1Protocol Feature
 id: afed80b2-d34b-11eb-a952-acde48001122
-version: 1
-date: '2021-06-22'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -10,9 +10,9 @@ description: This search is to detect a suspicious enabling of smb1protocol thro
   "powershell.exe". This technique was seen in some ransomware (like reddot) where
   it enable smb share to do the lateral movement and encrypt other files within the
   compromise network system.
-search: '`powershell` EventCode=4104 Message = "*Enable-WindowsOptionalFeature*" Message
+search: '`powershell` EventCode=4104 ScriptBlockText = "*Enable-WindowsOptionalFeature*" ScriptBlockText
   = "*SMB1Protocol*" | stats count min(_time) as firstTime max(_time) as lastTime
-  by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_enable_smb1protocol_feature_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the powershell logs  from your endpoints. make sure you enable needed
@@ -20,6 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: network operator may enable or disable this windows feature.
 references:
 - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -39,7 +40,7 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml
index 30626cd311..2b37775ff3 100644
--- a/detections/endpoint/powershell_execute_com_object.yml
+++ b/detections/endpoint/powershell_execute_com_object.yml
@@ -1,7 +1,7 @@
 name: Powershell Execute COM Object
 id: 65711630-f9bf-11eb-8d72-acde48001122
-version: 1
-date: '2021-08-10'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,9 +11,9 @@ description: This search is to detect a COM CLSID execution through powershell.
   it has a feature to execute command using COM Object. This technique may use by
   network operator at some cases but a good indicator if some application want to
   gain privilege escalation or bypass uac.
-search: '`powershell` EventCode=4104 Message = "*CreateInstance([type]::GetTypeFromCLSID*"
-  OR Message = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*CreateInstance([type]::GetTypeFromCLSID*"
+  OR ScriptBlockText = "*CreateInstance([Type]::GetTypeFromProgID*"| stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `powershell_execute_com_object_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
@@ -22,6 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
 known_false_positives: network operrator may use this command.
 references:
 - https://threadreaderapp.com/thread/1423361119926816776.html
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -36,13 +37,14 @@ tags:
   impact: 10
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains COM CLSID command in $Message$
-    with EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains COM CLSID command in $ScriptBlockText$
+    with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1546.015
   - T1546
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -56,5 +58,8 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Computer
+  - EventCode
   risk_score: 5
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index 714cc5862c..a73bbfea2d 100644
--- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -1,7 +1,7 @@
 name: Powershell Fileless Process Injection via GetProcAddress
 id: a26d9db4-c883-11eb-9d75-acde48001122
-version: 1
-date: '2021-06-08'
+version: 2
+date: '2022-02-25'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -21,8 +21,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message=*getprocaddress* | stats count min(_time)
-  as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+search: '`powershell` EventCode=4104 ScriptBlockText=*getprocaddress* | stats count min(_time)
+  as firstTime max(_time) as lastTime by OpCode Computer UserID EventCode ScriptBlockText
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -33,6 +33,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -46,14 +47,14 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains GetProcAddress API in $Message$
-    with EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains GetProcAddress API in $ScriptBlockText$
+    with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059
   - T1055
   - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -67,10 +68,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserID
   - EventCode
   risk_score: 48
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 9ebd2144a7..39f05656db 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -1,7 +1,7 @@
 name: Powershell Fileless Script Contains Base64 Encoded Content
 id: 8acbc04c-c882-11eb-b060-acde48001122
-version: 1
-date: '2021-06-08'
+version: 2
+date: '2022-02-25'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -20,8 +20,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time)
-  as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time)
+  as firstTime max(_time) as lastTime by OpCode Computer UserID EventCode ScriptBlockText
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -32,6 +32,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -46,14 +47,14 @@ tags:
   kill_chain_phases:
   - Exploitation
   - Privilege Escalation
-  message: A suspicious powershell script contains base64 command in $Message$ with
-    EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with
+    EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059
   - T1027
   - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -67,10 +68,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserID
   - EventCode
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
index 44df06b235..e50605dc8a 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
@@ -1,7 +1,7 @@
 name: Powershell Get LocalGroup Discovery with Script Block Logging
 id: d7c6ad22-155c-11ec-bb64-acde48001122
-version: 1
-date: '2021-09-14'
+version: 2
+date: '2022-02-25'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel: []
@@ -18,8 +18,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode|
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by ScriptBlockText OpCode Computer UserID EventCode|
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -32,9 +32,11 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -46,16 +48,17 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Local group discovery on $dest$ by $user$.
+  message: Local group discovery on $computer$ by $UserID$.
   mitre_attack_id:
   - T1069
   - T1069.001
+  - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
-  - name: user
+  - name: UserID
     type: User
     role:
     - Victim
@@ -66,8 +69,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
index 09c32ff942..cef0855e4d 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
@@ -1,7 +1,7 @@
 name: PowerShell Loading DotNET into Memory via System Reflection Assembly
 id: 85bc3f30-ca28-11eb-bd21-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-02-25'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -19,9 +19,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
-  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  User EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -34,6 +34,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -48,16 +49,16 @@ tags:
   kill_chain_phases:
   - Exploitation
   message: A suspicious powershell script contains reflective class assembly  command
-    in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$
+    in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059
   - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -67,10 +68,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserID
   - EventCode
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index cb00089ad5..1272638b82 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -1,7 +1,7 @@
 name: Powershell Processing Stream Of Data
 id: 0d718b52-c9f1-11eb-bc61-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -11,9 +11,9 @@ description: The following analytic identifies suspicious PowerShell script exec
   that are stream flattened and will be deflated durnig execution. During triage,
   review parallel processes within the same timeframe. Review the full script block
   to identify other related artifacts.
-search: '`powershell` EventCode=4104 Message = "*IO.Compression.*" OR Message = "*IO.StreamReader*"
-  OR Message = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*IO.Compression.*" OR ScriptBlockText = "*IO.StreamReader*"
+  OR ScriptBlockText = "*]::Decompress*" | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `powershell_processing_stream_of_data_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -25,6 +25,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -38,14 +39,14 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains stream command in $Message$ commonly
+  message: A suspicious powershell script contains stream command in $ScriptBlockText$ commonly
     for processing compressed or to decompressed binary file with EventCode $EventCode$
-    in host $ComputerName$
+    in host $Computer$
   mitre_attack_id:
   - T1059
   - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -60,9 +61,9 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   - Score
   risk_score: 40
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index 4a76a32e9a..090d83e8ce 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -1,7 +1,7 @@
 name: Powershell Remove Windows Defender Directory
 id: adf47620-79fa-11ec-b248-acde48001122
-version: 2
-date: '2022-01-18'
+version: 3
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,8 +11,8 @@ description: This analytic will identify a suspicious PowerShell command used to
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
-search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows Defender*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
+search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `powershell_remove_windows_defender_directory_filter` '
@@ -25,6 +25,7 @@ references:
 tags:
   analytic_story:
   - WhisperGate
+  - Malicious PowerShell
   automated_detection_testing: passed
   cis20:
   - CIS 3
@@ -39,18 +40,19 @@ tags:
   impact: 100
   kill_chain_phases:
   - Exploitation
-  message: suspicious powershell script $Message$ was executed on the $ComputerName$
+  message: suspicious powershell script $ScriptBlockText$ was executed on the $Computer$
   mitre_attack_id:
   - T1562.001
   - T1562
+  - T1059.001
   nist:
   - DE.CM
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -61,8 +63,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml
index 34f285569d..0da5ebdc5f 100644
--- a/detections/endpoint/powershell_using_memory_as_backing_store.yml
+++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml
@@ -1,7 +1,7 @@
 name: Powershell Using memory As Backing Store
 id: c396a0c4-c9f2-11eb-b4f5-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic identifies suspicious PowerShell script exec
   PowerShell script will contain stream flate data and will be decompressed in memory
   to run or drop the actual payload. During triage, review parallel processes within
   the same timeframe. Review the full script block to identify other related artifacts.
-search: '`powershell` EventCode=4104 Message = "*New-Object IO.MemoryStream*" | stats
-  count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*New-Object IO.MemoryStream*" | stats
+  count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
+  UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_using_memory_as_backing_store_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -38,16 +38,16 @@ tags:
   impact: 50
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains memorystream command in $Message$
-    as new object backstore with EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains memorystream command in $ScriptBlockText$
+    as new object backstore with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1140
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -58,8 +58,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 40
   security_domain: endpoint
diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
index 73b3d2921e..45b793b0be 100644
--- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
+++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml
@@ -1,7 +1,7 @@
 name: Powershell Windows Defender Exclusion Commands
 id: 907ac95c-4dd9-11ec-ba2c-acde48001122
-version: 1
-date: '2021-11-25'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -12,9 +12,9 @@ description: This analytic will detect a suspicious process commandline related
   path, file path, process, extensions and etc. from its real time or schedule scan
   to execute their malicious code. This is a good indicator for defense evasion and
   to look further for events after this behavior.
-search: '`powershell` EventCode=4104 (Message = "*Add-MpPreference *" OR Message =
-  "*Set-MpPreference *") AND Message = "*-exclusion*" | stats count min(_time) as
-  firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Add-MpPreference *" OR ScriptBlockText =
+  "*Set-MpPreference *") AND ScriptBlockText = "*-exclusion*" | stats count min(_time) as
+  firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `powershell_windows_defender_exclusion_commands_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
@@ -25,11 +25,13 @@ references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 - https://app.any.run/tasks/cf1245de-06a7-4366-8209-8e3006f2bfe5/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Remcos
   - Windows Defense Evasion Tactics
   - WhisperGate
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 80
   context:
@@ -40,16 +42,17 @@ tags:
   impact: 80
   kill_chain_phases:
   - Exploitation
-  message: exclusion command $Message$ executed on $ComputerName$
+  message: exclusion command $ScriptBlockText$ executed on $Computer$
   mitre_attack_id:
   - T1562.001
   - T1562
+  - T1059.001
   observable:
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -60,8 +63,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 64
   security_domain: endpoint
diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
index edeb6c723b..f6b8c66b01 100644
--- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
+++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml
@@ -1,7 +1,7 @@
 name: Recon AVProduct Through Pwh or WMI
 id: 28077620-c9f6-11eb-8785-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -11,9 +11,9 @@ description: The following analytic identifies suspicious PowerShell script exec
   adversary will map all running security applications or services. During triage,
   review parallel processes within the same timeframe. Review the full script block
   to identify other related artifacts.
-search: '`powershell` EventCode=4104 (Message = "*SELECT*" OR Message = "*WMIC*")
-  AND (Message = "*AntiVirusProduct*" OR Message = "*AntiSpywareProduct*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText = "*WMIC*")
+  AND (ScriptBlockText = "*AntiVirusProduct*" OR ScriptBlockText = "*AntiSpywareProduct*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
   User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `recon_avproduct_through_pwh_or_wmi_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -26,6 +26,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Ransomware
@@ -40,12 +41,12 @@ tags:
   impact: 70
   kill_chain_phases:
   - Reconnaissance
-  message: A suspicious powershell script contains AV recon command in $Message$ with
-    EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains AV recon command in $ScriptBlockText$ with
+    EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1592
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -60,8 +61,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 56
   security_domain: endpoint
diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml
index 203a04acdb..5aade581e1 100644
--- a/detections/endpoint/recon_using_wmi_class.yml
+++ b/detections/endpoint/recon_using_wmi_class.yml
@@ -1,7 +1,7 @@
 name: Recon Using WMI Class
 id: 018c1972-ca07-11eb-9473-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-02-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -11,11 +11,11 @@ description: The following analytic identifies suspicious PowerShell via EventCo
   and system information on the compromised machine. During triage, review parallel
   processes within the same timeframe. Review the full script block to identify other
   related artifacts.
-search: '`powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*")
-  AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*"
-  OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*"
-  OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*")
+  AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*"
+  OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*"
+  OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -27,6 +27,7 @@ references:
 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
 - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf
 - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Malicious PowerShell
@@ -40,12 +41,13 @@ tags:
   impact: 75
   kill_chain_phases:
   - Reconnaissance
-  message: A suspicious powershell script contains host recon command in $Message$
-    with EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains host recon command in $ScriptBlockText$
+    with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1592
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -60,8 +62,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 60
   security_domain: endpoint
diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
index 9bfba7f9c8..cf6e4a3a4f 100644
--- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via DCOM and PowerShell Script Block
 id: fa1c3040-4680-11ec-a618-3e22fbd008af
-version: 1
-date: '2021-11-15'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks
   for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries
   alike may abuse DCOM for lateral movement and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Document.Application.ShellExecute*"
-  OR Message="*Document.ActiveView.ExecuteShellCommand*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Document.Application.ShellExecute*"
+  OR ScriptBlockText="*Document.ActiveView.ExecuteShellCommand*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
@@ -22,6 +22,7 @@ known_false_positives: Administrators may leverage DCOM to start a process on re
 references:
 - https://attack.mitre.org/techniques/T1021/003/
 - https://www.cybereason.com/blog/dcom-lateral-movement-techniques
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Lateral Movement
@@ -35,13 +36,13 @@ tags:
   impact: 90
   kill_chain_phases:
   - Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing
+  message: A process was started on a remote endpoint from $Computer$ by abusing
     WMI using PowerShell.exe
   mitre_attack_id:
   - T1021
   - T1021.003
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -52,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index e11ab6af7d..faa4643c6d 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via WinRM and PowerShell Script Block
 id: 7d4c618e-4716-11ec-951c-3e22fbd008af
-version: 1
-date: '2021-11-16'
+version: 2
+date: '2022-02-25'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks
   for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike
   may abuse WinRM for lateral movement and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND ScriptBlockText="*-Computer*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  Computer UserID | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -23,9 +23,11 @@ known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to
 references:
 - https://attack.mitre.org/techniques/T1021/006/
 - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -36,13 +38,14 @@ tags:
   impact: 90
   kill_chain_phases:
   - Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing
+  message: A process was started on a remote endpoint from $Computer$ by abusing
     WinRM using PowerShell.exe
   mitre_attack_id:
   - T1021
   - T1021.006
+  - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -53,8 +56,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 45
   security_domain: endpoint
diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
index 5d9f138111..cf3780e670 100644
--- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml
@@ -9,9 +9,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
   to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries
   alike may abuse WMI and this commandlet for lateral movement and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
-  AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-WmiMethod*" AND ScriptBlockText="*-CN*"
+  AND ScriptBlockText="*-Class Win32_Process*" AND ScriptBlockText="*-Name create*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
   User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
@@ -22,9 +22,11 @@ known_false_positives: Administrators may leverage WWMI and powershell.exe to st
 references:
 - https://attack.mitre.org/techniques/T1047/
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Lateral Movement
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 70
   context:
@@ -35,12 +37,12 @@ tags:
   impact: 90
   kill_chain_phases:
   - Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing
+  message: A process was started on a remote endpoint from $Computer$ by abusing
     WMI using PowerShell.exe
   mitre_attack_id:
   - T1047
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -51,8 +53,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 63
   security_domain: endpoint
diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index bbfba4500d..f579e5acbf 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -9,9 +9,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to
   enumerate domain computers for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*objectclass=computer*"
-  AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
-  lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*objectclass=computer*"
+  AND ScriptBlockText = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
+  lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `remote_system_discovery_with_adsisearcher_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -49,8 +49,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
index 63098b3965..cfad3073fc 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
@@ -22,8 +22,8 @@ description: 'The following analytic identifies `powershell.exe` usage, using Sc
   class in PowerShell is the equivelant of using setspn.exe. \
 
   During triage, review parallel processes for further suspicious activity.'
-search: '`powershell` EventCode=4104 Message="*KerberosRequestorSecurityToken*" |
-  stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName
+search: '`powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*" |
+  stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode Computer
   User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `serviceprincipalnames_discovery_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml
index 3cbd73e2df..524d7ca7db 100644
--- a/detections/endpoint/unloading_amsi_via_reflection.yml
+++ b/detections/endpoint/unloading_amsi_via_reflection.yml
@@ -19,9 +19,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message=*system.management.automation.amsi* |
-  stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
-  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText=*system.management.automation.amsi* |
+  stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  User EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `unloading_amsi_via_reflection_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -47,11 +47,11 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$
+  message: Possible AMSI Unloading via Reflection using PowerShell on $Computer$
   mitre_attack_id:
   - T1562
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -61,10 +61,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserID
   - EventCode
   risk_score: 49
   security_domain: endpoint
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index cfa68d3777..b8a76fc442 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   logged user. Red Teams and adversaries may leverage this method to identify the
   logged user on a compromised endpoint for situational awareness and Active Directory
   Discovery.
-search: '`powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*$env:UserName*" OR ScriptBlockText = "*[System.Environment]::UserName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  Computer UserID | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -49,10 +49,10 @@ tags:
   required_fields:
   - _time
   - Path
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserID
   - EventCode
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml
index eb2a44d7b3..9fbf61ea6f 100644
--- a/detections/endpoint/wmi_recon_running_process_or_services.yml
+++ b/detections/endpoint/wmi_recon_running_process_or_services.yml
@@ -11,9 +11,9 @@ description: The following analytic identifies suspicious PowerShell script exec
   where the adversary will map all running security applications or services on the
   compromised machine. During triage, review parallel processes within the same timeframe.
   Review the full script block to identify other related artifacts.
-search: '`powershell` EventCode=4104 Message= "*SELECT*" AND (Message="*Win32_Process*"
-  OR Message="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as
-  lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText= "*SELECT*" AND (ScriptBlockText="*Win32_Process*"
+  OR ScriptBlockText="*Win32_Service*") | stats count min(_time) as firstTime max(_time) as
+  lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `wmi_recon_running_process_or_services_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -37,13 +37,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Suspicious powerShell script execution by $user$ on $ComputerName$ via
+  message: Suspicious powerShell script execution by $user$ on $Computer$ via
     EventCode 4104, where WMI is performing an event query looking for running processes
     or running services
   mitre_attack_id:
   - T1592
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -58,8 +58,8 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Computer
+  - UserID
   risk_score: 30
   security_domain: endpoint
diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
index ba9c5b83c7..7ca76800e1 100644
--- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
@@ -1,7 +1,7 @@
 name: Exchange PowerShell Module Usage
 id: 2d10095e-05ae-11ec-8fdf-acde48001122
-version: 1
-date: '2021-08-27'
+version: 2
+date: '2022-02-25'
 author: Michael Haag
 type: TTP
 datamodel: []
@@ -19,9 +19,9 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
   Module - New-managementroleassignment can assign a management role to a management
   role group, management role assignment policy, user, or universal security group
   (USG).'
-search: '`powershell` EventCode=4104 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by Path Message OpCode
-  ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by Path ScriptBlockText OpCode
+  Computer UserID EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_module_usage_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -34,9 +34,11 @@ references:
 - https://blog.orange.tw/2021/08/proxyshell-a-new-attack-surface-on-ms-exchange-part-3.html
 - https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell
 - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - ProxyShell
+  - Malicious PowerShell
   confidence: 50
   context:
   - Source:Endpoint
@@ -47,12 +49,12 @@ tags:
   kill_chain_phases:
   - Reconnaissance
   - Exploitation
-  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  message: Local user discovery enumeration using PowerShell on $Computer$ by $user$
   mitre_attack_id:
   - T1059
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -63,10 +65,10 @@ tags:
   required_fields:
   - _time
   - Path
-  - Message
+  - ScriptBlockText
   - OpCode
-  - ComputerName
-  - User
+  - Computer
+  - UserID
   - EventCode
   risk_score: 15
   security_domain: endpoint

From 5785354e77b579107310492186149d218c21d806 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 28 Feb 2022 09:34:40 -0700
Subject: [PATCH 02/48] Fixes

---
 ...allow_inbound_traffic_in_firewall_rule.yml |  2 +-
 .../delete_shadowcopy_with_powershell.yml     |  2 +-
 ...f_shadowcopy_with_script_block_logging.yml |  6 ++--
 ...e_with_powershell_script_block_logging.yml |  6 ++--
 ...z_with_powershell_script_block_logging.yml |  6 ++--
 ...thentication_discovery_with_get_aduser.yml |  6 ++--
 ...uthentication_discovery_with_powerview.yml |  6 ++--
 ...main_group_discovery_with_adsisearcher.yml |  6 ++--
 ...levated_group_discovery_with_powerview.yml |  6 ++--
 ...ordpolicy_with_powershell_script_block.yml |  2 +-
 ...et_aduser_with_powershell_script_block.yml |  4 +--
 ...ordpolicy_with_powershell_script_block.yml |  2 +-
 ...ainpolicy_with_powershell_script_block.yml |  2 +-
 ...maintrust_with_powershell_script_block.yml |  6 ++--
 ...omainuser_with_powershell_script_block.yml |  2 +-
 ...resttrust_with_powershell_script_block.yml |  6 ++--
 ...up_discovery_with_script_block_logging.yml |  8 ++---
 ...dcomputer_with_powershell_script_block.yml |  8 ++---
 ...etadgroup_with_powershell_script_block.yml |  6 ++--
 ...rent_user_with_powershell_script_block.yml | 10 +++---
 ...ncomputer_with_powershell_script_block.yml |  6 ++--
 ...ontroller_with_powershell_script_block.yml |  6 ++--
 ...maingroup_with_powershell_script_block.yml |  4 +--
 ...localuser_with_powershell_script_block.yml |  4 +--
 ...onnection_with_powershell_script_block.yml |  4 +--
 ..._computer_with_powershell_script_block.yml |  4 +--
 ..._ds_group_with_powershell_script_block.yml |  4 +--
 ...r_account_with_powershell_script_block.yml |  4 +--
 .../endpoint/powershell_4104_hunting.yml      |  2 +-
 ...s_process_injection_via_getprocaddress.yml |  4 +--
 ...script_contains_base64_encoded_content.yml |  4 +--
 ...up_discovery_with_script_block_logging.yml |  2 +-
 ..._memory_via_system_reflection_assembly.yml |  4 +--
 ...ote_system_discovery_with_adsisearcher.yml |  4 +--
 ...incipalnames_discovery_with_powershell.yml | 31 ++++++++-----------
 .../unloading_amsi_via_reflection.yml         |  4 +--
 ..._with_env_vars_powershell_script_block.yml | 10 +++---
 .../exchange_powershell_module_usage.yml      |  4 +--
 38 files changed, 102 insertions(+), 105 deletions(-)

diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
index a9bf409bb2..e2386d14d1 100644
--- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
+++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
@@ -60,6 +60,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 3
   security_domain: endpoint
diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index 933823423a..89540ab1d9 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -62,6 +62,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index d1e7cb247c..a8c02660da 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -20,7 +20,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*copy*","*[System.IO.File]::Copy*")
   AND ScriptBlockText IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
   UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -71,9 +71,9 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
-  - UserIDID
+  - UserID
   - EventCode
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
index 0d4ef85e91..6cb0719881 100644
--- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
@@ -20,7 +20,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104  (ScriptBlockText=*system.net.webclient* AND ScriptBlockText=*frombase64string*)
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
   UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `detect_empire_with_powershell_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -70,9 +70,9 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
-  - UserIDID
+  - UserID
   - EventCode
   risk_score: 81
   security_domain: endpoint
diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
index 39a419d35b..22ca6a6e9c 100644
--- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -20,7 +20,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText IN (*mimikatz*, *-dumpcr*, *sekurlsa::pth*,
   *kerberos::ptt*, *kerberos::golden*) | stats count min(_time) as firstTime max(_time)
-  as lastTime by OpCode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
+  as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `detect_mimikatz_with_powershell_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -67,9 +67,9 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
-  - UserIDID
+  - UserID
   - EventCode
   risk_score: 90
   security_domain: endpoint
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
index 949c490c86..dbfb581eb8 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
@@ -40,7 +40,7 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -53,7 +53,7 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   security_domain: endpoint
   impact: 60
   confidence: 90 
@@ -62,4 +62,4 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $dest$.
\ No newline at end of file
+  message: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser from $Computer$.
\ No newline at end of file
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index 2f84559451..2d9774a223 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -36,7 +36,7 @@ tags:
   - T1558.004
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -49,7 +49,7 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   security_domain: endpoint
   impact: 60
   confidence: 90 
@@ -58,4 +58,4 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $dest$
\ No newline at end of file
+  message: Disabled Kerberos Pre-Authentication Discovery With PowerView from $Computer$
\ No newline at end of file
diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
index f55463cc1b..7578fd1e9f 100644
--- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
@@ -36,13 +36,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerShell on $dest$ by $UserID$
+  message: Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$
   mitre_attack_id:
   - T1069
   - T1069.002
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -55,6 +55,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 18
   security_domain: endpoint
diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml
index a58d445604..0acda1f1a6 100644
--- a/detections/endpoint/elevated_group_discovery_with_powerview.yml
+++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml
@@ -42,13 +42,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Elevated group discovery using PowerView on $dest$ by $user$
+  message: Elevated group discovery using PowerView on $Computer$ by $user$
   mitre_attack_id:
   - T1069
   - T1069.002
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -61,6 +61,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 21
   security_domain: endpoint
diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
index aeb8111cb5..fa2278ac87 100644
--- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
@@ -60,6 +60,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml
index ca88ec4e7a..a2616134bf 100644
--- a/detections/endpoint/get_aduser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml
@@ -37,7 +37,7 @@ tags:
   impact: 50
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ for user enumeration
+  message: powershell process having commandline $ScriptBlockText$ for user enumeration
   mitre_attack_id:
   - T1087.002
   - T1087
@@ -60,6 +60,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
index 48a01826b8..e6a804fd1c 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
@@ -60,6 +60,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 9
   security_domain: endpoint
diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index 3e203c868d..6d4022c3c2 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -57,6 +57,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 30
   security_domain: endpoint
diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index deb8c2f203..29ff6e5216 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -18,7 +18,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by ScriptBlockText Computer UserID EventCode | `security_content_ctime(firstTime)`
+  as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer UserID EventCode | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -73,8 +73,8 @@ tags:
   - EventCode
   - ScriptBlockText
   - Path
-  - OpCode
+  - Opcode
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 12
   security_domain: endpoint
diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
index 6426d64e2e..0f6aff4d7b 100644
--- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml
@@ -57,6 +57,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 25
   security_domain: endpoint
diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
index 5f5888717c..a4fd367063 100644
--- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
@@ -18,7 +18,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by ScriptBlockText OpCode Computer UserID EventCode
+  as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer UserID EventCode
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_foresttrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -63,8 +63,8 @@ tags:
   - EventCode
   - ScriptBlockText
   - Path
-  - OpCode
+  - Opcode
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 12
   security_domain: endpoint
diff --git a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
index d26c7ba61c..5a93f838e2 100644
--- a/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/get_wmiobject_group_discovery_with_script_block_logging.yml
@@ -19,7 +19,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-WMIObject*" AND ScriptBlockText = "*Win32_Group*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by  Message OpCode
+  | stats count min(_time) as firstTime max(_time) as lastTime by  Message Opcode
   Computer UserID EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_wmiobject_group_discovery_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -49,13 +49,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: System group discovery enumeration on $dest$ by $UserID$.
+  message: System group discovery enumeration on $Computer$ by $UserID$.
   mitre_attack_id:
   - T1069
   - T1069.001
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -72,6 +72,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
index 9a3eb2e7fb..90d6cef479 100644
--- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
@@ -12,7 +12,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   and Active Directory Discovery.
 search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | stats count
   min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer
-  User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`'
+  UserID | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -37,12 +37,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery enumeration on $dest$ by $UserID$
+  message: Remote system discovery enumeration on $Computer$ by $UserID$
   mitre_attack_id:
   - T1018
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -55,6 +55,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml
index 3bcde3b136..b2079b8d41 100644
--- a/detections/endpoint/getadgroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml
@@ -37,12 +37,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerShell on $dest$ by $UserID$
+  message: Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$
   mitre_attack_id:
   - T1069
   - T1069.002
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -55,6 +55,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index dd916434b7..478794e979 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -12,7 +12,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   compromised endpoint for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 (ScriptBlockText = "*[System.Security.Principal.WindowsIdentity]*"
   AND ScriptBlockText = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time)
-  as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
+  as lastTime by EventCode ScriptBlockText Opcode Computer UserID | `security_content_ctime(firstTime)`
   | `getcurrent_user_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -38,12 +38,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: System user discovery on $dest$
+  message: System user discovery on $Computer$
   mitre_attack_id:
   - T1033
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -55,9 +55,9 @@ tags:
   - _time
   - Path
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
-  - UserIDID
+  - UserID
   - EventCode
   risk_score: 15
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
index 3394df1372..d5ad281414 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
@@ -35,12 +35,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery with PowerView on $dest$ by $UserID$
+  message: Remote system discovery with PowerView on $Computer$ by $UserID$
   mitre_attack_id:
   - T1018
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -53,6 +53,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 24
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
index 136c6006d6..c04329472b 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
@@ -37,12 +37,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery with PowerView on $dest$ by $UserID$
+  message: Remote system discovery with PowerView on $Computer$ by $UserID$
   mitre_attack_id:
   - T1018
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -55,6 +55,6 @@ tags:
   - EventCode
   - ScriptBlockText
   - Computer
-  - UserIDID
+  - UserID
   risk_score: 24
   security_domain: endpoint
diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
index b3b2e9c04f..a83c653b38 100644
--- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
@@ -38,13 +38,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerView on $dest$ by $user$
+  message: Domain group discovery enumeration using PowerView on $Computer$ by $user$
   mitre_attack_id:
   - T1069
   - T1069.002
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
index 8bbf5e022a..b9dd39e31a 100644
--- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml
+++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
@@ -35,13 +35,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  message: Local user discovery enumeration using PowerShell on $Computer$ by $user$
   mitre_attack_id:
   - T1087
   - T1087.001
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
index 9f2e47dde3..f6c23aaef4 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
@@ -37,12 +37,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Network Connection discovery on $dest$ by $user$
+  message: Network Connection discovery on $Computer$ by $user$
   mitre_attack_id:
   - T1049
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
index e37bcb077c..f013744de7 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
@@ -38,12 +38,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: Remote system discovery enumeration on $Computer$ by $user$
   mitre_attack_id:
   - T1018
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
index 15f7408716..9fa4725b49 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
@@ -38,13 +38,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
+  message: Domain group discovery enumeration using PowerShell on $Computer$ by $user$
   mitre_attack_id:
   - T1069
   - T1069.002
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index dbe970d57e..7b77976af4 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -35,13 +35,13 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  message: Local user discovery enumeration using PowerShell on $Computer$ by $user$
   mitre_attack_id:
   - T1087
   - T1087.001
   - T1059.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index 322f6fdc58..90ee36882b 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -60,7 +60,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ executing suspicious commands.
+    on endpoint $Computer$ by user $user$ executing suspicious commands.
   mitre_attack_id:
   - T1059
   - T1059.001
diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index a73bbfea2d..70a71ebc61 100644
--- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -22,7 +22,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText=*getprocaddress* | stats count min(_time)
-  as firstTime max(_time) as lastTime by OpCode Computer UserID EventCode ScriptBlockText
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_process_injection_via_getprocaddress_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -69,7 +69,7 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
   - UserID
   - EventCode
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 39f05656db..175d48a6d0 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -21,7 +21,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time)
-  as firstTime max(_time) as lastTime by OpCode Computer UserID EventCode ScriptBlockText
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -69,7 +69,7 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
   - UserID
   - EventCode
diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
index e50605dc8a..fef8b3d172 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
@@ -19,7 +19,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by ScriptBlockText OpCode Computer UserID EventCode|
+  as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer UserID EventCode|
   `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
index cef0855e4d..cd90a7b818 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
@@ -20,7 +20,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
   User EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -69,7 +69,7 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
   - UserID
   - EventCode
diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index f579e5acbf..005051c8f8 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -34,11 +34,11 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: Remote system discovery enumeration on $Computer$ by $user$
   mitre_attack_id:
   - T1018
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
index cfad3073fc..7ef586700d 100644
--- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
+++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml
@@ -1,7 +1,7 @@
 name: ServicePrincipalNames Discovery with PowerShell
 id: 13243068-2d38-11ec-8908-acde48001122
-version: 1
-date: '2021-10-14'
+version: 2
+date: '2022-02-26'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -23,8 +23,8 @@ description: 'The following analytic identifies `powershell.exe` usage, using Sc
 
   During triage, review parallel processes for further suspicious activity.'
 search: '`powershell` EventCode=4104 ScriptBlockText="*KerberosRequestorSecurityToken*" |
-  stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode Computer
-  User EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  stats count min(_time) as firstTime max(_time) as lastTime by ScriptBlockText Opcode Computer
+  UserID EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `serviceprincipalnames_discovery_with_powershell_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -49,6 +49,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   - Active Directory Kerberos Attacks
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 100
   context:
@@ -60,15 +61,15 @@ tags:
   kill_chain_phases:
   - Privilege Escalation
   message: An instance of $parent_process_name$ spawning $process_name$ was identified
-    on endpoint $dest$ by user $user$ attempting to identify service principle names.
+    on endpoint $Computer$ by user $UserID$ attempting to identify service principle names.
   mitre_attack_id:
   - T1558.003
   observable:
-  - name: user
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: dest
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -86,16 +87,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest
-  - Processes.user
-  - Processes.parent_process_name
-  - Processes.parent_process
-  - Processes.original_file_name
-  - Processes.process_name
-  - Processes.process
-  - Processes.process_id
-  - Processes.parent_process_path
-  - Processes.process_path
-  - Processes.parent_process_id
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCode
   risk_score: 80
   security_domain: endpoint
diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml
index 524d7ca7db..ee31059552 100644
--- a/detections/endpoint/unloading_amsi_via_reflection.yml
+++ b/detections/endpoint/unloading_amsi_via_reflection.yml
@@ -20,7 +20,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 ScriptBlockText=*system.management.automation.amsi* |
-  stats count min(_time) as firstTime max(_time) as lastTime by OpCode Computer
+  stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
   User EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `unloading_amsi_via_reflection_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -62,7 +62,7 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
   - UserID
   - EventCode
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index b8a76fc442..ee2cefb9ee 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -11,7 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   logged user on a compromised endpoint for situational awareness and Active Directory
   Discovery.
 search: '`powershell` EventCode=4104 (ScriptBlockText = "*$env:UserName*" OR ScriptBlockText = "*[System.Environment]::UserName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Opcode
   Computer UserID | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -20,9 +20,11 @@ known_false_positives: Administrators or power users may use this PowerShell com
   for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
+- https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Malicious PowerShell
   automated_detection_testing: passed
   confidence: 50
   context:
@@ -34,11 +36,11 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: System user discovery on $dest$
+  message: System user discovery on $Computer$
   mitre_attack_id:
   - T1033
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -50,7 +52,7 @@ tags:
   - _time
   - Path
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
   - UserID
   - EventCode
diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
index 7ca76800e1..419f451c88 100644
--- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
@@ -20,7 +20,7 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
   role group, management role assignment policy, user, or universal security group
   (USG).'
 search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by Path ScriptBlockText OpCode
+  | stats count min(_time) as firstTime max(_time) as lastTime by Path ScriptBlockText Opcode
   Computer UserID EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_module_usage_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -66,7 +66,7 @@ tags:
   - _time
   - Path
   - ScriptBlockText
-  - OpCode
+  - Opcode
   - Computer
   - UserID
   - EventCode

From 0fff58ca6b497e86143532029de634c1b5db96c8 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 1 Mar 2022 09:39:14 -0700
Subject: [PATCH 03/48] ADsisearcher

---
 detections/endpoint/adsisearcher_account_discovery.yml    | 2 +-
 .../endpoint/domain_group_discovery_with_adsisearcher.yml | 2 +-
 .../remote_system_discovery_with_adsisearcher.yml         | 2 +-
 tests/endpoint/adsisearcher_account_discovery.test.yml    | 8 ++++----
 .../domain_group_discovery_with_adsisearcher.test.yml     | 8 ++++----
 .../remote_system_discovery_with_adsisearcher.test.yml    | 8 ++++----
 6 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml
index 700b4bb272..82b492aa53 100644
--- a/detections/endpoint/adsisearcher_account_discovery.yml
+++ b/detections/endpoint/adsisearcher_account_discovery.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
   domain users for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" ScriptBlockText = "*objectcategory=user*"
-  ScriptBlockText = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime
+  ScriptBlockText IN ("*.findAll()*","*.findOne()*") | stats count min(_time) as firstTime max(_time) as lastTime
   by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `adsisearcher_account_discovery_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
index 7578fd1e9f..6e1744ee19 100644
--- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate
   domain groups for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*(objectcategory=group)*"
-  AND ScriptBlockText = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
+  AND ScriptBlockText IN ("*.findAll()*","*.findOne()*")| stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `domain_group_discovery_with_adsisearcher_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index 005051c8f8..92da879186 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to
   enumerate domain computers for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*objectclass=computer*"
-  AND ScriptBlockText = "*findAll()*") | stats count min(_time) as firstTime max(_time) as
+  AND ScriptBlockText IN ("*.findAll()*","*.findOne()*") | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `remote_system_discovery_with_adsisearcher_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
diff --git a/tests/endpoint/adsisearcher_account_discovery.test.yml b/tests/endpoint/adsisearcher_account_discovery.test.yml
index b727b66bb5..c136622cf0 100644
--- a/tests/endpoint/adsisearcher_account_discovery.test.yml
+++ b/tests/endpoint/adsisearcher_account_discovery.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
\ No newline at end of file
+  - file_name: adsisearcher-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml b/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml
index 1a7c735731..a89cfadec0 100644
--- a/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml
+++ b/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
\ No newline at end of file
+  - file_name: adsisearcher-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml b/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml
index dded02b553..e12ef9c885 100644
--- a/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml
+++ b/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
\ No newline at end of file
+  - file_name: adsisearcher-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file

From 57677f5c31905d923b80d7e5007de01c08f9a5a2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 1 Mar 2022 09:49:47 -0700
Subject: [PATCH 04/48] Allow inbound firewall rule

---
 detections/endpoint/adsisearcher_account_discovery.yml    | 2 +-
 .../endpoint/allow_inbound_traffic_in_firewall_rule.yml   | 3 ++-
 .../allow_inbound_traffic_in_firewall_rule.test.yml       | 8 ++++----
 3 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml
index 82b492aa53..5bf8e228f3 100644
--- a/detections/endpoint/adsisearcher_account_discovery.yml
+++ b/detections/endpoint/adsisearcher_account_discovery.yml
@@ -32,7 +32,7 @@ tags:
   - source:endpoint
   - stage:Reconnaissance
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
   impact: 50
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
index e2386d14d1..2e758fd9fd 100644
--- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
+++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml
@@ -22,6 +22,7 @@ known_false_positives: administrator may allow inbound traffic in certain networ
 references:
 - https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1021.001/T1021.001.md#atomic-test-3---changing-rdp-port-to-non-standard-port-via-powershell
 tags:
   analytic_story:
   - Prohibited Traffic Allowed or Protocol Mismatch
@@ -32,7 +33,7 @@ tags:
   - Source:Endpoint
   - Stage:Lateral Movement
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/firewall-powershell.log
   impact: 10
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml
index ac2dd09fa0..acdb033466 100644
--- a/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml
+++ b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
\ No newline at end of file
+  - file_name: firewall-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/firewall-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file

From 89df8759c671fd1a2110c83a2683861d23f387d2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 1 Mar 2022 13:54:27 -0700
Subject: [PATCH 05/48] second pass

---
 .../endpoint/delete_shadowcopy_with_powershell.yml    |  3 ++-
 ...t_copy_of_shadowcopy_with_script_block_logging.yml |  3 ++-
 ..._mimikatz_with_powershell_script_block_logging.yml |  2 +-
 ...s_pre_authentication_discovery_with_get_aduser.yml |  3 ++-
 ...os_pre_authentication_discovery_with_powerview.yml |  4 ++--
 .../domain_group_discovery_with_adsisearcher.yml      |  2 +-
 .../delete_shadowcopy_with_powershell.test.yml        |  8 ++++----
 ...y_of_shadowcopy_with_script_block_logging.test.yml |  8 ++++----
 ...katz_with_powershell_script_block_logging.test.yml |  8 ++++----
 ..._authentication_discovery_with_get_aduser.test.yml | 11 ++++-------
 ...e_authentication_discovery_with_powerview.test.yml |  8 ++++----
 11 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index 89540ab1d9..87dad167d2 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -23,6 +23,7 @@ references:
 - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
 - https://searchwindowsserver.techtarget.com/tutorial/Set-up-PowerShell-script-block-logging-for-added-security
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
 tags:
   analytic_story:
   - DarkSide Ransomware
@@ -35,7 +36,7 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/shadow-powershell.log
   impact: 90
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
index a8c02660da..0b6d5f7453 100644
--- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
@@ -33,6 +33,7 @@ references:
 - https://github.com/GossiTheDog/HiveNightmare
 - https://github.com/JumpsecLabs/Guidance-Advice/tree/main/SAM_Permissions
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-6---dump-volume-shadow-copy-hives-with-systemiofile
 tags:
   analytic_story:
   - Credential Dumping
@@ -45,7 +46,7 @@ tags:
   cve:
   - CVE-2021-36934
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/serioussam/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/copy-powershell.log
   impact: 80
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
index 22ca6a6e9c..2c63b9cd7d 100644
--- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml
@@ -42,7 +42,7 @@ tags:
   - Source:Endpoint
   - Stage:Credential Access
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
   impact: 90
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
index dbfb581eb8..2b02fcabc1 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
@@ -21,6 +21,7 @@ known_false_positives: Administrators or power users may use search for accounts
 references:
 - https://attack.mitre.org/techniques/T1558/004/
 - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
+- https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/useraccountcontrol-manipulate-account-properties
 - https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/
 - https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
 tags:
@@ -28,7 +29,7 @@ tags:
   - Active Directory Kerberos Attacks
   - Malicious PowerShell
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index 2d9774a223..7c92851e52 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -11,7 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   As the name suggests, `Get-DomainUser` is used to identify domain users and combining it with `-PreauthNotRequired`
   allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
   Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts and attempt to crack their passwords offline.
-search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
   | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -28,7 +28,7 @@ tags:
   - Active Directory Kerberos Attacks
   - Malicious PowerShell
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/getdomainuser-powershell.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
index 6e1744ee19..232c72f4a2 100644
--- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml
@@ -32,7 +32,7 @@ tags:
   - Stage:Discovery
   - Stage:Recon
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/adsisearcher-powershell.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
index 3f36a62eff..263d48d2fd 100644
--- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
+++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
\ No newline at end of file
+  - file_name: shadow-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/shadow-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
index b5d5b7a310..23da15cb73 100644
--- a/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
+++ b/tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/serioussam/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
\ No newline at end of file
+  - file_name: copy-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/copy-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
index f03fd4d85e..d566e9bd42 100644
--- a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
+++ b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
\ No newline at end of file
+  - file_name: credaccess-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
index 034af504ea..3696e78e80 100644
--- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
+++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
@@ -6,10 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
-
-
-
+  - file_name: get-aduser-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file
diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
index 95445f94db..08f0b6f334 100644
--- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
+++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
\ No newline at end of file
+  - file_name: getdomainuser-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/getdomainuser-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
\ No newline at end of file

From 4600bd00f7cc6eb28278a1844c6dbbe9879134fb Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 8 Mar 2022 11:07:16 -0700
Subject: [PATCH 06/48] aduser

---
 ...ed_kerberos_pre_authentication_discovery_with_get_aduser.yml | 2 +-
 detections/endpoint/get_aduser_with_powershell_script_block.yml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
index 2b02fcabc1..1fa5815c94 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is part of the Active Directory PowerShell module used to manage Windows Active Directory networks.
   As the name suggests, `Get-ADUser` is used to query for domain users. With the appropiate parameters, Get-ADUser 
   allows adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
-  Red Teams and adversaries alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack their passwords offline.
+  Red Teams and adversaries alike use may abuse Get-ADUser to enumerate these accounts and attempt to crack their passwords offline.
 search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
   | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml
index a2616134bf..8db9e344b4 100644
--- a/detections/endpoint/get_aduser_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml
@@ -33,7 +33,7 @@ tags:
   - source:endpoint
   - stage:Reconnaissance
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log
   impact: 50
   kill_chain_phases:
   - Reconnaissance

From dbcc2d6d5b2893f75e0a55fbd86b2a6c870c7dec Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 26 Apr 2022 11:46:01 -0600
Subject: [PATCH 07/48] Update
 powershell_fileless_script_contains_base64_encoded_content.yml

---
 ...script_contains_base64_encoded_content.yml | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 9db6cc1d80..6be2fe62a8 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -1,7 +1,7 @@
 name: Powershell Fileless Script Contains Base64 Encoded Content
 id: 8acbc04c-c882-11eb-b060-acde48001122
-version: 1
-date: '2021-06-08'
+version: 2
+date: '2022-04-26'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -20,8 +20,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message=*frombase64string* | stats count min(_time)
-  as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message
+search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -41,7 +41,7 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log
   impact: 70
   kill_chain_phases:
   - Exploitation
@@ -66,11 +66,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
-  - OpCode
-  - ComputerName
-  - User
-  - EventCode
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCodes
   risk_score: 56
   security_domain: endpoint
   asset_type: Endpoint

From 63674d843f34f7caed2590af9dfb10c66e72ec3b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 26 Apr 2022 11:57:50 -0600
Subject: [PATCH 08/48] update

---
 ...up_discovery_with_script_block_logging.yml | 19 ++++++++++---------
 ...t_contains_base64_encoded_content.test.yml |  8 ++++----
 ...scovery_with_script_block_logging.test.yml |  4 ++--
 3 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
index 332ca9476a..59b4e448c7 100644
--- a/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
+++ b/detections/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.yml
@@ -1,7 +1,7 @@
 name: Powershell Get LocalGroup Discovery with Script Block Logging
 id: d7c6ad22-155c-11ec-bb64-acde48001122
-version: 1
-date: '2021-09-14'
+version: 2
+date: '2022-04-26'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel: []
@@ -18,9 +18,9 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode|
-  `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`'
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-localgroup*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -40,7 +40,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
@@ -63,10 +63,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 15
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
index 1a75d8e2c6..072014e251 100644
--- a/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
+++ b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: frombase64string.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
diff --git a/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml b/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml
index afb412a246..80322d4b4a 100644
--- a/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml
+++ b/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-powershell.log
+  - file_name: getlocalgroup.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log
     source: WinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: wineventlog

From c9ecc29065fd014a3cb5ca396d966818e9cfce02 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 26 Apr 2022 12:06:47 -0600
Subject: [PATCH 09/48] recon

---
 detections/endpoint/recon_using_wmi_class.yml | 2 +-
 tests/endpoint/recon_using_wmi_class.test.yml | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml
index 7b7bf1ef0b..28a0a9ead6 100644
--- a/detections/endpoint/recon_using_wmi_class.yml
+++ b/detections/endpoint/recon_using_wmi_class.yml
@@ -37,7 +37,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log
   impact: 75
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/recon_using_wmi_class.test.yml b/tests/endpoint/recon_using_wmi_class.test.yml
index 83de3af306..4cc79e8a7a 100644
--- a/tests/endpoint/recon_using_wmi_class.test.yml
+++ b/tests/endpoint/recon_using_wmi_class.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

From 63b83bfc7a58af8ac8573e79061329be8046cb5b Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 06:32:06 -0600
Subject: [PATCH 10/48] Update exchange_powershell_module_usage.yml

---
 .../endpoint/exchange_powershell_module_usage.yml | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
index 45ce11a430..829ef1a648 100644
--- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
@@ -19,9 +19,9 @@ description: 'The following analytic identifies the usage of Exchange PowerShell
   Module - New-managementroleassignment can assign a management role to a management
   role group, management role assignment policy, user, or universal security group
   (USG).'
-search: '`powershell` EventCode=4104 Message IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by Path Message OpCode
-  ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*New-MailboxExportRequest*", "*New-ManagementRoleAssignment*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by lastTime by Opcode Computer
+  UserID EventCode ScriptBlockText| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `exchange_powershell_module_usage_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -63,11 +63,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Path
-  - Message
-  - OpCode
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
   risk_score: 15
   security_domain: endpoint

From d342b02b71af1403e9d809ba08f9f594ad69e966 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 06:32:55 -0600
Subject: [PATCH 11/48] Update exchange_powershell_module_usage.yml

---
 .../endpoint/exchange_powershell_module_usage.yml             | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/experimental/endpoint/exchange_powershell_module_usage.yml b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
index 829ef1a648..172e39c8e4 100644
--- a/detections/experimental/endpoint/exchange_powershell_module_usage.yml
+++ b/detections/experimental/endpoint/exchange_powershell_module_usage.yml
@@ -1,7 +1,7 @@
 name: Exchange PowerShell Module Usage
 id: 2d10095e-05ae-11ec-8fdf-acde48001122
-version: 1
-date: '2021-08-27'
+version: 2
+date: '2022-05-02'
 author: Michael Haag
 type: TTP
 datamodel: []

From 8d647c14247bf8ac18f90ae16ecf3c66a1756093 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 09:02:27 -0600
Subject: [PATCH 12/48] quickie

---
 ...tadcomputer_with_powershell_script_block.yml | 17 +++++++++--------
 .../powershell_creating_thread_mutex.yml        |  6 +++---
 ...ess_process_injection_via_getprocaddress.yml |  2 +-
 ...mputer_with_powershell_script_block.test.yml |  4 ++--
 .../powershell_creating_thread_mutex.test.yml   |  8 ++++----
 ...rocess_injection_via_getprocaddress.test.yml |  8 ++++----
 6 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
index 1eae787f11..ca8e3f691e 100644
--- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetAdComputer with PowerShell Script Block
 id: a9a1da02-8e27-4bf7-a348-f4389c9da487
-version: 1
-date: '2021-09-01'
+version: 2
+date: '2022-04-26'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is used to return a list of all domain computers. Red Teams and adversaries may
   leverage this commandlet to enumerate domain computers for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-AdComputer*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-AdComputer*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by Opcode Computer
+  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getadcomputer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -47,10 +47,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 15
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml
index 69484f6f0a..bd2bb44a59 100644
--- a/detections/endpoint/powershell_creating_thread_mutex.yml
+++ b/detections/endpoint/powershell_creating_thread_mutex.yml
@@ -1,7 +1,7 @@
 name: Powershell Creating Thread Mutex
 id: 637557ec-ca08-11eb-bd0a-acde48001122
-version: 2
-date: '2022-02-25'
+version: 3
+date: '2022-05-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -33,7 +33,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 50
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
index c786630486..63548c9b3e 100644
--- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
+++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml
@@ -43,7 +43,7 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 60
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
index 1c2b617a8b..c9d4cef41d 100644
--- a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
@@ -8,5 +8,5 @@ tests:
   attack_data:
   - file_name: windows-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/powershell_creating_thread_mutex.test.yml b/tests/endpoint/powershell_creating_thread_mutex.test.yml
index a32d89cab3..2b8cf7a3c0 100644
--- a/tests/endpoint/powershell_creating_thread_mutex.test.yml
+++ b/tests/endpoint/powershell_creating_thread_mutex.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog
diff --git a/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
index 2ec67fbc06..44a2982c22 100644
--- a/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
+++ b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

From a11ca5314ddf67079508a7b95fa3269f9bc8b5b1 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 09:15:47 -0600
Subject: [PATCH 13/48] shadow

---
 .../delete_shadowcopy_with_powershell.yml     | 24 ++++++++++---------
 ...delete_shadowcopy_with_powershell.test.yml |  6 ++---
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index 7688461d92..d739552df7 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -1,7 +1,7 @@
 name: Delete ShadowCopy With PowerShell
 id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122
-version: 1
-date: '2021-05-12'
+version: 2
+date: '2022-05-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,9 +11,10 @@ description: This following analytic detects PowerShell command to delete shadow
   to deploy DarkSide Ransomware where it executed a child process of PowerShell to
   execute a hex encoded command to delete shadow copy. This hex encoded command was
   able to be decrypted by PowerShell log.
-search: '`powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete*"
-  OR Message = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
-  by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText= "*ShadowCopy*" (ScriptBlockText = "*Delete*"
+  OR ScriptBlockText = "*Remove*") | stats count min(_time) as firstTime max(_time) as lastTime
+  by Opcode Computer
+  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `delete_shadowcopy_with_powershell_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the powershell logs  from your endpoints. make sure you enable needed
@@ -32,11 +33,11 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$
+  message: An attempt to delete ShadowCopy was performed using PowerShell on $Computer$
     by $User$.
   mitre_attack_id:
   - T1490
@@ -45,7 +46,7 @@ tags:
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -55,10 +56,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 81
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
index f65c6f0c59..7d19847709 100644
--- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
+++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/revil/inf1/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

From 54ee69397b3cd67b9597fd7a133215d953d16a62 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 09:47:56 -0600
Subject: [PATCH 14/48] snipe

---
 .../endpoint/mailsniper_invoke_functions.yml  | 23 ++++++++++---------
 .../mailsniper_invoke_functions.test.yml      |  8 +++----
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml
index 30c12cc1ec..8c8ad272fc 100644
--- a/detections/endpoint/mailsniper_invoke_functions.yml
+++ b/detections/endpoint/mailsniper_invoke_functions.yml
@@ -1,7 +1,7 @@
 name: Mailsniper Invoke functions
 id: a36972c8-b894-11eb-9f78-acde48001122
-version: 1
-date: '2021-05-19'
+version: 2
+date: '2022-05-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -9,12 +9,12 @@ datamodel:
 description: This search is to detect known mailsniper.ps1 functions executed in a
   machine. This technique was seen in some attacker to harvest some sensitive e-mail
   in a compromised exchange server.
-search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*",
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Invoke-GlobalO365MailSearch*",
   "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*",
   "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*",
   "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
+  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `mailsniper_invoke_functions_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the powershell logs  from your endpoints. make sure you enable needed
@@ -30,17 +30,17 @@ tags:
   - Source:Endpoint
   - Stage:Exfiltration
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user
+  message: mailsniper.ps1 functions $ScriptBlockText$ executed on a $Computer$ by user
     $user$.
   mitre_attack_id:
   - T1114
   - T1114.001
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -54,10 +54,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 72
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/mailsniper_invoke_functions.test.yml b/tests/endpoint/mailsniper_invoke_functions.test.yml
index 43be48b636..510a3d3845 100644
--- a/tests/endpoint/mailsniper_invoke_functions.test.yml
+++ b/tests/endpoint/mailsniper_invoke_functions.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

From c8358acf36d4aa34291dbddd4424d132042ec251 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 12:28:17 -0600
Subject: [PATCH 15/48] getdomain getnettcp

---
 ...ncomputer_with_powershell_script_block.yml | 23 ++++++++++---------
 ...onnection_with_powershell_script_block.yml | 23 ++++++++++---------
 ...uter_with_powershell_script_block.test.yml |  8 +++----
 ...tion_with_powershell_script_block.test.yml |  8 +++----
 4 files changed, 32 insertions(+), 30 deletions(-)

diff --git a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
index 80b3df3b2d..90d0d49390 100644
--- a/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincomputer_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetDomainComputer with PowerShell Script Block
 id: f64da023-b988-4775-8d57-38e512beb56e
-version: 1
-date: '2021-09-02'
+version: 2
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
   Red Teams and adversaries alike may use PowerView to enumerate domain computers
   for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainComputer*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by Opcode Computer
+  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincomputer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -28,15 +28,15 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery with PowerView on $dest$ by $user$
+  message: Remote system discovery with PowerView on $Computer$ by $user$
   mitre_attack_id:
   - T1018
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -46,10 +46,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 24
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
index 08ff9f6fbe..20c27ba936 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetNetTcpconnection with PowerShell Script Block
 id: 091712ff-b02a-4d43-82ed-34765515d95d
-version: 1
-date: '2021-09-10'
+version: 2
+date: '2022-04-02'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is used to return a listing of network connections on a compromised system. Red
   Teams and adversaries alike may use this commandlet for situational awareness and
   Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-NetTcpconnection*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-NetTcpconnection*") | stats
+  count min(_time) as firstTime max(_time) as lastTime by Opcode Computer
+  UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getnettcpconnection_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -29,15 +29,15 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Network Connection discovery on $dest$ by $user$
+  message: Network Connection discovery on $Computer$ by $user$
   mitre_attack_id:
   - T1049
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -47,10 +47,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 15
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml b/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml
index 4502690697..e55896da11 100644
--- a/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog
diff --git a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
index 088d172453..73c37ec150 100644
--- a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 544f6094288f2f3a1a3e0d585c47ffeac540a960 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 12:30:30 -0600
Subject: [PATCH 16/48] Update
 detect_mimikatz_with_powershell_script_block_logging.test.yml

---
 ...mimikatz_with_powershell_script_block_logging.test.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
index 68444245ca..d919fd25fa 100644
--- a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
+++ b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: credaccess-powershell.log
+    data:https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog

From f56aa3bfb9663ca6a0707d5b906f42f850cad6e5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 12:36:02 -0600
Subject: [PATCH 17/48] remote

---
 ..._via_winrm_and_powershell_script_block.yml | 22 +++++++++----------
 ...winrm_and_powershell_script_block.test.yml |  8 +++----
 2 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
index d4e8129d1c..40f710a2b8 100644
--- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
+++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via WinRM and PowerShell Script Block
 id: 7d4c618e-4716-11ec-951c-3e22fbd008af
-version: 1
-date: '2021-11-16'
+version: 2
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks
   for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike
   may abuse WinRM for lateral movement and remote code execution.
-search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText="*Invoke-Command*" AND ScriptBlockText="*-ComputerName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
   can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -31,17 +30,17 @@ tags:
   - Source:Endpoint
   - Stage:Lateral Movement
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 90
   kill_chain_phases:
   - Exploitation
-  message: A process was started on a remote endpoint from $ComputerName by abusing
+  message: A process was started on a remote endpoint from $Computer$ by abusing
     WinRM using PowerShell.exe
   mitre_attack_id:
   - T1021
   - T1021.006
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -51,10 +50,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 45
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml
index 8bdcf76bcb..79a5b9c3ec 100644
--- a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml
+++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 445cce67ca78dede99876d4d9a28c16990ef8f84 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 12:39:31 -0600
Subject: [PATCH 18/48] get-aduser

---
 ...ordpolicy_with_powershell_script_block.yml | 24 +++++++++----------
 ...licy_with_powershell_script_block.test.yml |  8 +++----
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
index 39be4ce713..221882212d 100644
--- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
@@ -1,8 +1,8 @@
 name: Get ADUserResultantPasswordPolicy with Powershell Script Block
 id: 737e1eb0-065a-11ec-921a-acde48001122
-version: 1
-date: '2021-08-26'
-author: Teoderick Contreras, MAuricio Velazco, Splunk
+version: 2
+date: '2022-05-02'
+author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
@@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   used to obtain the password policy in a Windows domain. Red Teams and adversaries
   alike may use PowerShell to enumerate domain policies for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText="*Get-ADUserResultantPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -30,16 +29,16 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ to query domain user password
+  message: powershell process having commandline $ScriptBlockText$ to query domain user password
     policy.
   mitre_attack_id:
   - T1201
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -53,10 +52,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 9
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
index 72007a7295..f2aec50ec8 100644
--- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From fe1077bbc196ac04973f41f14409eb3c84563f68 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 12:42:12 -0600
Subject: [PATCH 19/48] get-adcomputer

---
 .../getadcomputer_with_powershell_script_block.yml        | 8 ++++----
 .../getadcomputer_with_powershell_script_block.test.yml   | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/getadcomputer_with_powershell_script_block.yml b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
index ca8e3f691e..a1f5a58c00 100644
--- a/detections/endpoint/getadcomputer_with_powershell_script_block.yml
+++ b/detections/endpoint/getadcomputer_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetAdComputer with PowerShell Script Block
 id: a9a1da02-8e27-4bf7-a348-f4389c9da487
-version: 2
-date: '2022-04-26'
+version: 3
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -33,11 +33,11 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: Remote system discovery enumeration on $Computer$ by $UserID$
   mitre_attack_id:
   - T1018
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
diff --git a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
index c9d4cef41d..2252682e9c 100644
--- a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: Xmlwineventlog
\ No newline at end of file

From a2c4b0fe41028162b08e57461a7a848fc72566f2 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 12:46:36 -0600
Subject: [PATCH 20/48] wmiobject

---
 .../endpoint/wmi_recon_running_process_or_services.yml   | 9 +++++----
 .../wmi_recon_running_process_or_services.test.yml       | 8 ++++----
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml
index 53ad41294b..11d4ff7d14 100644
--- a/detections/endpoint/wmi_recon_running_process_or_services.yml
+++ b/detections/endpoint/wmi_recon_running_process_or_services.yml
@@ -1,7 +1,7 @@
 name: WMI Recon Running Process Or Services
 id: b5cd5526-cce7-11eb-b3bd-acde48001122
-version: 1
-date: '2021-06-14'
+version: 2
+date: '2022-05-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -33,7 +33,7 @@ tags:
   - Source:Endpoint
   - Stage:Recon
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
@@ -57,10 +57,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - EventCode
   - ScriptBlockText
+  - Opcode
   - Computer
   - UserID
+  - EventCode
   risk_score: 30
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/wmi_recon_running_process_or_services.test.yml b/tests/endpoint/wmi_recon_running_process_or_services.test.yml
index b18eb8cfb0..e384ee3fb3 100644
--- a/tests/endpoint/wmi_recon_running_process_or_services.test.yml
+++ b/tests/endpoint/wmi_recon_running_process_or_services.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 4df5ba9c6bb13d6a18eb4451e3422c9a1b48e091 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 12:54:16 -0600
Subject: [PATCH 21/48] wmiob

---
 ..._ds_group_with_powershell_script_block.yml | 20 +++++++++----------
 ...roup_with_powershell_script_block.test.yml |  8 ++++----
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
index a07988555c..f34ece15a0 100644
--- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetWmiObject Ds Group with PowerShell Script Block
 id: 67740bd3-1506-469c-b91d-effc322cc6e5
-version: 1
-date: '2021-08-25'
+version: 2
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams
   and adversaries may leverage this commandlet to enumerate domain groups for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
-  root\\directory\\ldap*" AND Message="*class ds_group*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace root\\directory\\ldap*" AND ScriptBlockText="*class ds_group*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_group_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,11 +29,11 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerShell on $dest$ by $user$
+  message: Domain group discovery enumeration using PowerShell on $Computer$ by $UserID$
   mitre_attack_id:
   - T1069
   - T1069.002
@@ -49,10 +48,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 15
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml
index 0fc0f1421e..846174406c 100644
--- a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 32fb175794c2dd1baabdad005f46ccd26a86792a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:12:26 -0600
Subject: [PATCH 22/48] domainpoilicy

---
 ...ainpolicy_with_powershell_script_block.yml | 21 ++++++++++---------
 ...licy_with_powershell_script_block.test.yml |  8 +++----
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index 6744435f73..713ddcb8e1 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get DomainPolicy with Powershell Script Block
 id: a360d2b2-065a-11ec-b0bf-acde48001122
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-05-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel: []
@@ -9,7 +9,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the execution of the `Get DomainPolicy` commandlet used to obtain the
   password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell
   to enumerate domain policies for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
+search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | stats count min(_time)
   as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
@@ -28,19 +28,19 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 50
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ to query domain policy.
+  message: powershell process having commandline $ScriptBlockText$ to query domain policy.
   mitre_attack_id:
   - T1201
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -50,10 +50,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 30
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
index d65f4ccf3e..6d47d774e4 100644
--- a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 05aef331c85a029f0b354bc03c2ae45050890b8e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:14:49 -0600
Subject: [PATCH 23/48] policy+dc

---
 ...ainpolicy_with_powershell_script_block.yml |  2 +-
 ...ontroller_with_powershell_script_block.yml | 20 +++++++++----------
 ...ller_with_powershell_script_block.test.yml |  8 ++++----
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index 713ddcb8e1..66b909d490 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell
   to enumerate domain policies for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 ScriptBlockText ="*Get-DomainPolicy*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
index e698e1f783..b3592edebb 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetDomainController with PowerShell Script Block
 id: 676b600a-a94d-4951-b346-11329431e6c1
-version: 1
-date: '2021-09-02'
+version: 2
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -11,8 +11,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   Red Teams and adversaries alike may use PowerView to enumerate domain computers
   for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats
-  count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`'
+  count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -29,15 +28,15 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery with PowerView on $dest$ by $user$
+  message: Remote system discovery with PowerView on $Computer$ by $UserID$
   mitre_attack_id:
   - T1018
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -47,10 +46,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 24
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
index 183634e851..f3d2967d1c 100644
--- a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From e1c4b45c900643bf2d2a131a41d51c6f2f6f5aff Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:17:47 -0600
Subject: [PATCH 24/48] ds_com

---
 ..._computer_with_powershell_script_block.yml | 23 ++++++++++---------
 ...uter_with_powershell_script_block.test.yml |  8 +++----
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
index 5b9ad0fee1..43cc651c0b 100644
--- a/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetWmiObject Ds Computer with PowerShell Script Block
 id: 29b99201-723c-4118-847a-db2b3d3fb8ea
-version: 1
-date: '2021-09-01'
+version: 2
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   parameter leverages WMI to query for all domain computers. Red Teams and adversaries
   may leverage this commandlet to enumerate domain computers for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message="*namespace
-  root\\directory\\ldap*" AND Message="*class ds_computer*") | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 (ScriptBlockText=*Get-WmiObject* AND ScriptBlockText="*namespace
+  root\\directory\\ldap*" AND ScriptBlockText="*class ds_computer*") | stats count min(_time)
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `getwmiobject_ds_computer_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -30,15 +30,15 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: Remote system discovery enumeration on $Computer$ by $UserID$
   mitre_attack_id:
   - T1018
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -48,10 +48,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 15
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml
index ca7ff36731..0cef155ed2 100644
--- a/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 25b61fe888ec51043b669c10f415152f4ca53ddc Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:19:54 -0600
Subject: [PATCH 25/48] hunt

---
 detections/endpoint/powershell_4104_hunting.yml | 7 ++++++-
 tests/endpoint/powershell_4104_hunting.test.yml | 9 +++++----
 2 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index 84ffa54513..b5de4d2f22 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -56,7 +56,8 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 80
   kill_chain_phases:
   - Exploitation
@@ -89,6 +90,10 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCode
   risk_score: 80
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/powershell_4104_hunting.test.yml b/tests/endpoint/powershell_4104_hunting.test.yml
index 5ee81bda27..f23564d1c3 100644
--- a/tests/endpoint/powershell_4104_hunting.test.yml
+++ b/tests/endpoint/powershell_4104_hunting.test.yml
@@ -6,7 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_testing/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog
+

From f382a79f046c962bac274bdd7907e83ce8408bef Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:22:20 -0600
Subject: [PATCH 26/48] getdomaingr

---
 ...maingroup_with_powershell_script_block.yml | 20 +++++++++----------
 .../endpoint/powershell_4104_hunting.yml      |  4 ++--
 ...roup_with_powershell_script_block.test.yml |  8 ++++----
 3 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
index 4db3760c8c..1b6be40ee7 100644
--- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetDomainGroup with PowerShell Script Block
 id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53
-version: 1
-date: '2021-08-26'
+version: 2
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -11,9 +11,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams
   and adversaries may leverage this function to enumerate domain groups for situational
   awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count
-  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
-  User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainGroup*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -34,12 +33,12 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Domain group discovery enumeration using PowerView on $dest$ by $user$
+  message: Domain group discovery enumeration using PowerView on $Computer$ by $UserID$
   mitre_attack_id:
   - T1069
   - T1069.002
   observable:
-  - name: dest
+  - name: Computer
     type: Endpoint
     role:
     - Victim
@@ -49,10 +48,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 15
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index b5de4d2f22..2ce3656a74 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -1,7 +1,7 @@
 name: PowerShell 4104 Hunting
 id: d6f2b006-0041-11ec-8885-acde48001122
-version: 2
-date: '2022-02-25'
+version: 3
+date: '2022-05-02'
 author: Michael Haag, Splunk
 type: Hunting
 datamodel: []
diff --git a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
index 296c581cd8..747a1312c2 100644
--- a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From ef7f385fca877b77d4a2255d28b509fa852b221c Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:25:01 -0600
Subject: [PATCH 27/48] object

---
 ...miobject_user_account_with_powershell_script_block.yml | 6 +++---
 ...ect_user_account_with_powershell_script_block.test.yml | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index 1059f7564a..bb3a548d47 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetWmiObject User Account with PowerShell Script Block
 id: 640b0eda-0429-11ec-accd-acde48001122
-version: 1
-date: '2021-08-23'
+version: 2
+date: '2022-05-02'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel: []
@@ -34,7 +34,7 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Local user discovery enumeration using PowerShell on $Computer$ by $user$
+  message: Local user discovery enumeration using PowerShell on $Computer$ by $UserID$
   mitre_attack_id:
   - T1087
   - T1087.001
diff --git a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
index 7b099a2b03..1b63470ddf 100644
--- a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From b420befa57d2e508fd130acff7ea15b9a7a6bd42 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:27:03 -0600
Subject: [PATCH 28/48] spnpwsh

---
 ...rviceprincipalnames_discovery_with_powershell.test.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
index e5c9cdd982..434db4115e 100644
--- a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
+++ b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell_kerberos.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 86ef111278211e0a18bd7d63a0f20ed49021fd47 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:29:09 -0600
Subject: [PATCH 29/48] domaintrust

---
 ...maintrust_with_powershell_script_block.yml | 25 +++++++++----------
 ...rust_with_powershell_script_block.test.yml |  8 +++---
 2 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index 910ee5d880..da7bc28b82 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: Get-DomainTrust with PowerShell Script Block
 id: 89275e7e-0548-11ec-bf75-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-05-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -17,8 +17,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Message ComputerName User EventCode | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-domaintrust*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -43,16 +43,16 @@ tags:
   impact: 30
   kill_chain_phases:
   - Reconnaissance
-  message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $ComputerName$
-    by user $user$.
+  message: Suspicious PowerShell Get-DomainTrust was identified on endpoint $Computer$
+    by user $UserID$.
   mitre_attack_id:
   - T1482
   observable:
-  - name: user
+  - name: UserID
     type: User
     role:
     - Victim
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -66,12 +66,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - Path
-  - OpCode
-  - ComputerName
-  - User
   risk_score: 12
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
index e6d8b8e1df..0bcfcf6a2e 100644
--- a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog:Microsoft-Windows-PowerShell/Operational
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From b7f47677e6a86160e78b7b2d98a3be5957e08547 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:30:16 -0600
Subject: [PATCH 30/48] Update
 serviceprincipalnames_discovery_with_powershell.test.yml

---
 .../serviceprincipalnames_discovery_with_powershell.test.yml    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
index 434db4115e..39578d5133 100644
--- a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
+++ b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: Xmlwineventlog
\ No newline at end of file

From e2f90a30f0335d3751038d2dd570fd132e198127 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:32:55 -0600
Subject: [PATCH 31/48] enum

---
 detections/endpoint/powershell_domain_enumeration.yml | 6 ++++--
 tests/endpoint/powershell_domain_enumeration.test.yml | 8 ++++----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml
index 9b7ff001a8..7ff4bf2902 100644
--- a/detections/endpoint/powershell_domain_enumeration.yml
+++ b/detections/endpoint/powershell_domain_enumeration.yml
@@ -40,7 +40,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 60
   kill_chain_phases:
   - Reconnaissance
@@ -54,7 +54,7 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -65,7 +65,9 @@ tags:
   required_fields:
   - _time
   - ScriptBlockText
+  - Opcode
   - Computer
+  - UserID
   - EventCode
   risk_score: 42
   security_domain: endpoint
diff --git a/tests/endpoint/powershell_domain_enumeration.test.yml b/tests/endpoint/powershell_domain_enumeration.test.yml
index 6d025312f2..1c84d1b13a 100644
--- a/tests/endpoint/powershell_domain_enumeration.test.yml
+++ b/tests/endpoint/powershell_domain_enumeration.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 657678b29cabcb1e3f281ce9454146dc06a6fdc5 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:35:11 -0600
Subject: [PATCH 32/48] smb1

---
 .../endpoint/powershell_enable_smb1protocol_feature.yml   | 2 +-
 .../powershell_enable_smb1protocol_feature.test.yml       | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
index c20a4ab8b6..974bb42a8e 100644
--- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml
+++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml
@@ -30,7 +30,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   kill_chain_phases:
   - Exploitation
   message: Powershell Enable SMB1Protocol Feature
diff --git a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml
index 13c95788b5..e36ee63c92 100644
--- a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml
+++ b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From dcc707ce3611f09e9469bc3492dec5fdd89bda5a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:38:30 -0600
Subject: [PATCH 33/48] stream

---
 .../endpoint/powershell_processing_stream_of_data.yml     | 4 ++--
 .../powershell_processing_stream_of_data.test.yml         | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index 24644b7f1c..e7cdee7290 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -35,7 +35,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 50
   kill_chain_phases:
   - Exploitation
@@ -50,7 +50,7 @@ tags:
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
diff --git a/tests/endpoint/powershell_processing_stream_of_data.test.yml b/tests/endpoint/powershell_processing_stream_of_data.test.yml
index 4efed82800..7a21143a5b 100644
--- a/tests/endpoint/powershell_processing_stream_of_data.test.yml
+++ b/tests/endpoint/powershell_processing_stream_of_data.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From ee22b528e86495c6c03c8ac4c3e2c7aef0e36567 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:41:01 -0600
Subject: [PATCH 34/48] dsuser

---
 ...t_ds_user_with_powershell_script_block.yml | 21 ++++++++++---------
 ...user_with_powershell_script_block.test.yml |  8 +++----
 2 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
index 867d819d10..1da9780554 100644
--- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml
@@ -1,7 +1,7 @@
 name: GetWmiObject DS User with PowerShell Script Block
 id: fabd364e-04f3-11ec-b34b-acde48001122
-version: 1
-date: '2021-08-24'
+version: 2
+date: '2022-05-02'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -10,9 +10,9 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   parameter leverages WMI to query for all domain users. Red Teams and adversaries
   may leverage this commandlet to enumerate domain users for situational awareness
   and Active Directory Discovery.
-search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*"
-  Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*get-wmiobject*" ScriptBlockText = "*ds_user*"
+  ScriptBlockText = "*-namespace*" ScriptBlockText = "*root\\directory\\ldap*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `getwmiobject_ds_user_with_powershell_script_block_filter`'
 how_to_implement: he following Hunting analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
@@ -33,12 +33,12 @@ tags:
   impact: 50
   kill_chain_phases:
   - Reconnaissance
-  message: powershell process having commandline $Message$ for user enumeration
+  message: powershell process having commandline $ScriptBlockText$ for user enumeration
   mitre_attack_id:
   - T1087.002
   - T1087
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
@@ -52,10 +52,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 25
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml
index 49113fd821..65b230298f 100644
--- a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 5127dc01ff8083a806a3bae18817ba91dacc9489 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:45:02 -0600
Subject: [PATCH 35/48] rmdir

---
 ...hell_remove_windows_defender_directory.yml | 23 +++++++++----------
 ...remove_windows_defender_directory.test.yml |  8 +++----
 2 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml
index 272c081ed4..adf93972c7 100644
--- a/detections/endpoint/powershell_remove_windows_defender_directory.yml
+++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml
@@ -1,7 +1,7 @@
 name: Powershell Remove Windows Defender Directory
 id: adf47620-79fa-11ec-b248-acde48001122
-version: 2
-date: '2022-01-18'
+version: 3
+date: '2022-05-02'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -11,9 +11,7 @@ description: This analytic will identify a suspicious PowerShell command used to
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
-search: '`powershell` EventCode=4104 Message = "*rmdir *" AND Message = "*\\Microsoft\\Windows
-  Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
-  Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText = "*rmdir *" AND ScriptBlockText = "*\\Microsoft\\Windows Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_remove_windows_defender_directory_filter` '
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -34,22 +32,22 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 100
   kill_chain_phases:
   - Exploitation
-  message: suspicious powershell script $Message$ was executed on the $ComputerName$
+  message: suspicious powershell script $ScriptBlockText$ was executed on the $Computer$
   mitre_attack_id:
   - T1562.001
   - T1562
   nist:
   - DE.CM
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -59,10 +57,11 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 90
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/tests/endpoint/powershell_remove_windows_defender_directory.test.yml b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml
index 7d2b2a107f..71cf4cbf59 100644
--- a/tests/endpoint/powershell_remove_windows_defender_directory.test.yml
+++ b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/rmdir_defender_pwsh/powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
\ No newline at end of file
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog
\ No newline at end of file

From b8a9323e6bcddcf3a5911babea009d1020e3e7e9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 13:48:02 -0600
Subject: [PATCH 36/48] reflect

---
 ...ding_dotnet_into_memory_via_reflection.yml | 27 +++++++++----------
 ...dotnet_into_memory_via_reflection.test.yml |  8 +++---
 2 files changed, 17 insertions(+), 18 deletions(-)

diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
index dd6af6110a..77dc9abbcd 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
@@ -1,7 +1,7 @@
 name: PowerShell Loading DotNET into Memory via Reflection
 id: 85bc3f30-ca28-11eb-bd21-acde48001122
-version: 1
-date: '2021-06-10'
+version: 2
+date: '2022-05-02'
 author: Michael Haag, Splunk
 type: TTP
 datamodel: []
@@ -19,9 +19,8 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName
-  User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_loading_dotnet_into_memory_via_reflection_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
@@ -43,21 +42,21 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains reflective class assembly  command
-    in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains reflective class assembly command
+    in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059
   - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
@@ -67,10 +66,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Message
-  - OpCode
-  - ComputerName
-  - User
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
   risk_score: 56
   security_domain: endpoint
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
index da5bf70239..9f1fde69a5 100644
--- a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
+++ b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: sbl_xml.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: Xmlwineventlog

From 6c150078d97cbf1eb050af60daf395b3515c60ba Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Mon, 2 May 2022 14:00:54 -0600
Subject: [PATCH 37/48] Update
 detect_mimikatz_with_powershell_script_block_logging.test.yml

---
 ...ect_mimikatz_with_powershell_script_block_logging.test.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
index d919fd25fa..8429006cc3 100644
--- a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
+++ b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: credaccess-powershell.log
-    data:https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: XmlWinEventLog
\ No newline at end of file

From 7637c4c052b878a11d99ec781a365934d508bb39 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 6 May 2022 09:25:49 -0600
Subject: [PATCH 38/48] fixes

---
 ..._authentication_discovery_with_get_aduser.yml | 16 ++++++++--------
 ...e_authentication_discovery_with_powerview.yml | 16 ++++++++--------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
index 8ef58fda2a..fa8b174e4c 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
@@ -1,7 +1,7 @@
 name: Disabled Kerberos Pre-Authentication Discovery With Get-ADUser
 id: 114c6bfe-9406-11ec-bcce-acde48001122
-version: 1
-date: '2022-02-22'
+version: 2
+date: '2022-05-03'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -13,9 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   domain accounts with Kerberos Pre Authentication disabled.\ Red Teams and adversaries
   alike use may abuse Get-ADUSer to enumerate these accounts and attempt to crack
   their passwords offline.
-search: ' `powershell` EventCode=4104 (Message = "*Get-ADUser*" AND Message="*4194304*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
+search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-ADUser*" AND ScriptBlockText="*4194304*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_get_aduser_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -54,9 +53,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 54
   security_domain: endpoint
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index 26e0cc5247..e4455d6ea0 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -1,7 +1,7 @@
 name: Disabled Kerberos Pre-Authentication Discovery With PowerView
 id: b0b34e2c-90de-11ec-baeb-acde48001122
-version: 1
-date: '2022-02-18'
+version: 2
+date: '2022-05-03'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -13,9 +13,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   adversaries to discover domain accounts with Kerberos Pre Authentication disabled.\
   Red Teams and adversaries alike use may leverage PowerView to enumerate these accounts
   and attempt to crack their passwords offline.
-search: ' `powershell` EventCode=4104 (Message = "*Get-DomainUser*" AND Message="*PreauthNotRequired*")
-  | stats count min(_time)  as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
+search: ' `powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainUser*" AND ScriptBlockText="*PreauthNotRequired*")
+  | stats count min(_time)  as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `disabled_kerberos_pre_authentication_discovery_with_powerview_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -53,9 +52,10 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
   - EventCode
-  - Message
-  - ComputerName
-  - User
   risk_score: 54
   security_domain: endpoint

From 3532991644c4c3e9693e3b992a5cdc416bead26b Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 27 Jun 2022 16:27:32 -0700
Subject: [PATCH 39/48] Updating other spellings of XmlWinEventLog to
 xmlwineventlog.  At least in data ingest, this is case sensitive.

---
 tests/endpoint/delete_shadowcopy_with_powershell.test.yml       | 2 +-
 ...etect_mimikatz_with_powershell_script_block_logging.test.yml | 2 +-
 ...rberos_pre_authentication_discovery_with_get_aduser.test.yml | 2 +-
 ...erberos_pre_authentication_discovery_with_powerview.test.yml | 2 +-
 tests/endpoint/disabling_folderoptions_windows_feature.test.yml | 2 +-
 ...ltdomainpasswordpolicy_with_powershell_script_block.test.yml | 2 +-
 ...esultantpasswordpolicy_with_powershell_script_block.test.yml | 2 +-
 .../get_domainpolicy_with_powershell_script_block.test.yml      | 2 +-
 .../get_domaintrust_with_powershell_script_block.test.yml       | 2 +-
 .../get_domainuser_with_powershell_script_block.test.yml        | 2 +-
 .../get_foresttrust_with_powershell_script_block.test.yml       | 2 +-
 .../getadcomputer_with_powershell_script_block.test.yml         | 2 +-
 .../getdomaincomputer_with_powershell_script_block.test.yml     | 2 +-
 .../getdomaincontroller_with_powershell_script_block.test.yml   | 2 +-
 .../getdomaingroup_with_powershell_script_block.test.yml        | 2 +-
 .../endpoint/getlocaluser_with_powershell_script_block.test.yml | 2 +-
 .../getnettcpconnection_with_powershell_script_block.test.yml   | 2 +-
 ...twmiobject_ds_computer_with_powershell_script_block.test.yml | 2 +-
 .../getwmiobject_ds_group_with_powershell_script_block.test.yml | 2 +-
 .../getwmiobject_ds_user_with_powershell_script_block.test.yml  | 2 +-
 ...wmiobject_user_account_with_powershell_script_block.test.yml | 2 +-
 tests/endpoint/mailsniper_invoke_functions.test.yml             | 2 +-
 tests/endpoint/powershell_4104_hunting.test.yml                 | 2 +-
 tests/endpoint/powershell_creating_thread_mutex.test.yml        | 2 +-
 tests/endpoint/powershell_domain_enumeration.test.yml           | 2 +-
 tests/endpoint/powershell_enable_smb1protocol_feature.test.yml  | 2 +-
 ...shell_fileless_process_injection_via_getprocaddress.test.yml | 2 +-
 ...ell_fileless_script_contains_base64_encoded_content.test.yml | 2 +-
 ...owershell_loading_dotnet_into_memory_via_reflection.test.yml | 2 +-
 tests/endpoint/powershell_processing_stream_of_data.test.yml    | 2 +-
 .../powershell_remove_windows_defender_directory.test.yml       | 2 +-
 tests/endpoint/recon_using_wmi_class.test.yml                   | 2 +-
 .../serviceprincipalnames_discovery_with_powershell.test.yml    | 2 +-
 tests/endpoint/wmi_recon_running_process_or_services.test.yml   | 2 +-
 34 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
index 7d19847709..d579f5f910 100644
--- a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
+++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
index 8429006cc3..e23bfe2b90 100644
--- a/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
+++ b/tests/endpoint/detect_mimikatz_with_powershell_script_block_logging.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: credaccess-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/credaccess-powershell.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
\ No newline at end of file
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
index 3696e78e80..9681402e71 100644
--- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
+++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: get-aduser-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/getaduser/get-aduser-powershell.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
\ No newline at end of file
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
index 08f0b6f334..7113a224ef 100644
--- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
+++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: getdomainuser-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/getdomainuser-powershell.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
\ No newline at end of file
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
index b5252c8271..205ea854c7 100644
--- a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
+++ b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
@@ -19,4 +19,4 @@ tests:
   - file_name: windows-sysmon.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: xmlwineventlogE
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
index 48001f2acc..f582bda359 100644
--- a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
index f2aec50ec8..875b673a77 100644
--- a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
index 6d47d774e4..a93bf6c609 100644
--- a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
index 0bcfcf6a2e..934af76f43 100644
--- a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
index c943f9ecea..53fd5e1b21 100644
--- a/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainuser_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml b/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml
index 58b0b2f3f0..f68214c8f1 100644
--- a/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_foresttrust_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
index 2252682e9c..f6f9013d14 100644
--- a/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getadcomputer_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml b/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml
index e55896da11..6dde3ca382 100644
--- a/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaincomputer_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
index f3d2967d1c..fb2a0f294b 100644
--- a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
index 747a1312c2..7beb96f3fd 100644
--- a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
index 3303bde512..b2abc4915b 100644
--- a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell-xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
index 73c37ec150..eab18e2e26 100644
--- a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml
index 0cef155ed2..d0516a0f98 100644
--- a/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_ds_computer_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml
index 846174406c..b24d2be1ee 100644
--- a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml
index 65b230298f..6dc922ff78 100644
--- a/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_ds_user_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
index 1b63470ddf..2cc3314696 100644
--- a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/mailsniper_invoke_functions.test.yml b/tests/endpoint/mailsniper_invoke_functions.test.yml
index 510a3d3845..12a13cdc61 100644
--- a/tests/endpoint/mailsniper_invoke_functions.test.yml
+++ b/tests/endpoint/mailsniper_invoke_functions.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_4104_hunting.test.yml b/tests/endpoint/powershell_4104_hunting.test.yml
index f23564d1c3..f5521e4a8a 100644
--- a/tests/endpoint/powershell_4104_hunting.test.yml
+++ b/tests/endpoint/powershell_4104_hunting.test.yml
@@ -9,5 +9,5 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
 
diff --git a/tests/endpoint/powershell_creating_thread_mutex.test.yml b/tests/endpoint/powershell_creating_thread_mutex.test.yml
index 2b8cf7a3c0..37c4689bf6 100644
--- a/tests/endpoint/powershell_creating_thread_mutex.test.yml
+++ b/tests/endpoint/powershell_creating_thread_mutex.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_domain_enumeration.test.yml b/tests/endpoint/powershell_domain_enumeration.test.yml
index 1c84d1b13a..b1476b2c38 100644
--- a/tests/endpoint/powershell_domain_enumeration.test.yml
+++ b/tests/endpoint/powershell_domain_enumeration.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml
index e36ee63c92..f473641d83 100644
--- a/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml
+++ b/tests/endpoint/powershell_enable_smb1protocol_feature.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
index 44a2982c22..0440e79f08 100644
--- a/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
+++ b/tests/endpoint/powershell_fileless_process_injection_via_getprocaddress.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
index 072014e251..4e29d2f76b 100644
--- a/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
+++ b/tests/endpoint/powershell_fileless_script_contains_base64_encoded_content.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: frombase64string.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/frombase64string.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
index 9f1fde69a5..22b8d92979 100644
--- a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
+++ b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_processing_stream_of_data.test.yml b/tests/endpoint/powershell_processing_stream_of_data.test.yml
index 7a21143a5b..0014a8b8f8 100644
--- a/tests/endpoint/powershell_processing_stream_of_data.test.yml
+++ b/tests/endpoint/powershell_processing_stream_of_data.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_remove_windows_defender_directory.test.yml b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml
index 71cf4cbf59..57f2901f9f 100644
--- a/tests/endpoint/powershell_remove_windows_defender_directory.test.yml
+++ b/tests/endpoint/powershell_remove_windows_defender_directory.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/recon_using_wmi_class.test.yml b/tests/endpoint/recon_using_wmi_class.test.yml
index 4cc79e8a7a..ff3eb94fe1 100644
--- a/tests/endpoint/recon_using_wmi_class.test.yml
+++ b/tests/endpoint/recon_using_wmi_class.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: windows-powershell.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
index 39578d5133..3851ac94cb 100644
--- a/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
+++ b/tests/endpoint/serviceprincipalnames_discovery_with_powershell.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
\ No newline at end of file
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/wmi_recon_running_process_or_services.test.yml b/tests/endpoint/wmi_recon_running_process_or_services.test.yml
index e384ee3fb3..88c920da1a 100644
--- a/tests/endpoint/wmi_recon_running_process_or_services.test.yml
+++ b/tests/endpoint/wmi_recon_running_process_or_services.test.yml
@@ -9,4 +9,4 @@ tests:
   - file_name: sbl_xml.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: Xmlwineventlog
+    sourcetype: xmlwineventlog

From 8424c1fed1acc80c8ce677e968d453c3328f13a0 Mon Sep 17 00:00:00 2001
From: Michael Haag <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 28 Jun 2022 13:35:31 -0600
Subject: [PATCH 40/48] Update
 getdomaincontroller_with_powershell_script_block.yml

---
 .../getdomaincontroller_with_powershell_script_block.yml        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
index b3592edebb..dd6e5c1638 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains.
   Red Teams and adversaries alike may use PowerView to enumerate domain computers
   for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*Get-DomainController*") | stats
+search: '`powershell` EventCode=4104 (ScriptBlockText = "*Get-DomainController*") | stats
   count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `getdomaincontroller_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here

From 0ae31b8ef17b6131752f9718e723f4d4c62a76da Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 29 Jun 2022 10:00:23 -0600
Subject: [PATCH 41/48] streamreader

---
 detections/endpoint/powershell_processing_stream_of_data.yml | 2 +-
 tests/endpoint/powershell_processing_stream_of_data.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml
index e7cdee7290..f1916b6e27 100644
--- a/detections/endpoint/powershell_processing_stream_of_data.yml
+++ b/detections/endpoint/powershell_processing_stream_of_data.yml
@@ -35,7 +35,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log
   impact: 50
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/powershell_processing_stream_of_data.test.yml b/tests/endpoint/powershell_processing_stream_of_data.test.yml
index 0014a8b8f8..c76cfddc9b 100644
--- a/tests/endpoint/powershell_processing_stream_of_data.test.yml
+++ b/tests/endpoint/powershell_processing_stream_of_data.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: streamreader.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/streamreader.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From ca93df0797804d5f2d50bf35016c0b604787c6f3 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 29 Jun 2022 10:13:46 -0600
Subject: [PATCH 42/48] adsi

---
 .../remote_system_discovery_with_adsisearcher.yml         | 8 ++++----
 .../remote_system_discovery_with_adsisearcher.test.yml    | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index b4e2d8b8ff..e55a241a1a 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -1,7 +1,7 @@
 name: Remote System Discovery with Adsisearcher
 id: 70803451-0047-4e12-9d63-77fa7eb8649c
-version: 1
-date: '2021-09-01'
+version: 2
+date: '2022-06-29'
 author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
@@ -9,7 +9,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to
   enumerate domain computers for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*objectclass=computer*"
+search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*objectclass=computer*"
   AND ScriptBlockText IN ("*.findAll()*","*.findOne()*") | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `remote_system_discovery_with_adsisearcher_filter`'
@@ -29,7 +29,7 @@ tags:
   - Stage:Discovery
   - Stage:Recon
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml b/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml
index adee413abd..6068ceec4a 100644
--- a/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml
+++ b/tests/endpoint/remote_system_discovery_with_adsisearcher.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/AD_discovery/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+  - file_name: adsisearcher-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.002/AD_discovery/adsisearcher-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog

From 23d89687bea8460883c28605477a76803e35853e Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 29 Jun 2022 10:21:35 -0600
Subject: [PATCH 43/48] win32proc

---
 detections/endpoint/wmi_recon_running_process_or_services.yml | 2 +-
 tests/endpoint/wmi_recon_running_process_or_services.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml
index 11d4ff7d14..2babfd001a 100644
--- a/detections/endpoint/wmi_recon_running_process_or_services.yml
+++ b/detections/endpoint/wmi_recon_running_process_or_services.yml
@@ -33,7 +33,7 @@ tags:
   - Source:Endpoint
   - Stage:Recon
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/wmi_recon_running_process_or_services.test.yml b/tests/endpoint/wmi_recon_running_process_or_services.test.yml
index 88c920da1a..1241bd7cb4 100644
--- a/tests/endpoint/wmi_recon_running_process_or_services.test.yml
+++ b/tests/endpoint/wmi_recon_running_process_or_services.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: win32process.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/win32process.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From 8da41163ae2f9536a0cc9ddefaca01d195250ac9 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 29 Jun 2022 10:35:44 -0600
Subject: [PATCH 44/48] reflection

---
 .../powershell_loading_dotnet_into_memory_via_reflection.yml  | 4 ++--
 ...ershell_loading_dotnet_into_memory_via_reflection.test.yml | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
index 77dc9abbcd..e63435e80d 100644
--- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
+++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
@@ -19,7 +19,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   During triage, review parallel processes using an EDR product or 4688 events. It
   will be important to understand the timeline of events around this activity. Review
   the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*")
+search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*")
   | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_loading_dotnet_into_memory_via_reflection_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -42,7 +42,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log
   impact: 70
   kill_chain_phases:
   - Exploitation
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
index 22b8d92979..35727127ad 100644
--- a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
+++ b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: reflection.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From 2920c25c93cbc66aefeec3c7186d255d1b5cc530 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 29 Jun 2022 11:45:21 -0600
Subject: [PATCH 45/48] fixes

---
 ...detect_empire_with_powershell_script_block_logging.yml | 2 +-
 ...rberos_pre_authentication_discovery_with_powerview.yml | 2 +-
 .../get_domainpolicy_with_powershell_script_block.yml     | 2 +-
 .../get_domaintrust_with_powershell_script_block.yml      | 2 +-
 .../getdomaingroup_with_powershell_script_block.yml       | 2 +-
 .../getnettcpconnection_with_powershell_script_block.yml  | 2 +-
 detections/endpoint/powershell_domain_enumeration.yml     | 2 +-
 ...t_empire_with_powershell_script_block_logging.test.yml | 8 ++++----
 ...s_pre_authentication_discovery_with_powerview.test.yml | 4 ++--
 ...get_domainpolicy_with_powershell_script_block.test.yml | 4 ++--
 .../get_domaintrust_with_powershell_script_block.test.yml | 4 ++--
 .../getdomaingroup_with_powershell_script_block.test.yml  | 4 ++--
 ...nettcpconnection_with_powershell_script_block.test.yml | 4 ++--
 tests/endpoint/powershell_domain_enumeration.test.yml     | 4 ++--
 ...ocalgroup_discovery_with_script_block_logging.test.yml | 4 ++--
 15 files changed, 25 insertions(+), 25 deletions(-)

diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
index 58192c7251..d8bffdf820 100644
--- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
+++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml
@@ -45,7 +45,7 @@ tags:
   - Source:Endpoint
   - Stage:Execution
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log
   impact: 90
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
index e4455d6ea0..fbf03d36c4 100644
--- a/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
+++ b/detections/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.yml
@@ -33,7 +33,7 @@ tags:
   - Stage:Discovery
   - Stage:Recon
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log
   impact: 60
   kill_chain_phases:
   - Exploitation
diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
index 66b909d490..d6e944a375 100644
--- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml
@@ -28,7 +28,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log
   impact: 50
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index da7bc28b82..4bf401ea62 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -39,7 +39,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
index 1b6be40ee7..607e9d353d 100644
--- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml
@@ -29,7 +29,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
index 20c27ba936..b0bb08410a 100644
--- a/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
+++ b/detections/endpoint/getnettcpconnection_with_powershell_script_block.yml
@@ -29,7 +29,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml
index 7ff4bf2902..ee1e9e2b14 100644
--- a/detections/endpoint/powershell_domain_enumeration.yml
+++ b/detections/endpoint/powershell_domain_enumeration.yml
@@ -40,7 +40,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log
   impact: 60
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml b/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml
index d0feb73f8a..d626e4857d 100644
--- a/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml
+++ b/tests/endpoint/detect_empire_with_powershell_script_block_logging.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+  - file_name: empire.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/empire.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
diff --git a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
index 7113a224ef..02ec15cf55 100644
--- a/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
+++ b/tests/endpoint/disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: getdomainuser-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powerview/getdomainuser-powershell.log
+  - file_name: getdomainuser.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdomainuser.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
index a93bf6c609..ce3a2f2de5 100644
--- a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: domainpolicy.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domainpolicy.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog
diff --git a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
index 934af76f43..5c4f7c7267 100644
--- a/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
+++ b/tests/endpoint/get_domaintrust_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: domaintrust.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaintrust.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
index 7beb96f3fd..3ca580680e 100644
--- a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: domaingroup.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/domaingroup.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog
diff --git a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
index eab18e2e26..743e244d53 100644
--- a/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getnettcpconnection_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: nettcpconnection.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/nettcpconnection.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_domain_enumeration.test.yml b/tests/endpoint/powershell_domain_enumeration.test.yml
index b1476b2c38..e9d8fa1345 100644
--- a/tests/endpoint/powershell_domain_enumeration.test.yml
+++ b/tests/endpoint/powershell_domain_enumeration.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: enumeration.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/enumeration.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog
diff --git a/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml b/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml
index 80322d4b4a..9442c06b3d 100644
--- a/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml
+++ b/tests/endpoint/powershell_get_localgroup_discovery_with_script_block_logging.test.yml
@@ -8,5 +8,5 @@ tests:
   attack_data:
   - file_name: getlocalgroup.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getlocalgroup.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: wineventlog
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog

From 04689116764b0be6dd80a1f763071a3f8ea58043 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 29 Jun 2022 12:57:59 -0600
Subject: [PATCH 46/48] fixes2

---
 .../getdomaincontroller_with_powershell_script_block.yml      | 2 +-
 .../getdomaincontroller_with_powershell_script_block.test.yml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
index dd6e5c1638..61fa6f4cb1 100644
--- a/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
+++ b/detections/endpoint/getdomaincontroller_with_powershell_script_block.yml
@@ -28,7 +28,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log
   impact: 30
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
index fb2a0f294b..d46b967c4e 100644
--- a/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getdomaincontroller_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: sbl_xml.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - file_name: getdc.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/getdc.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: xmlwineventlog

From eb0fe08f1f7ca8f6fb93c7a336cf24b771fdd059 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 29 Jun 2022 13:58:10 -0600
Subject: [PATCH 47/48] Update remote_system_discovery_with_adsisearcher.yml

---
 .../endpoint/remote_system_discovery_with_adsisearcher.yml    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index e55a241a1a..c593bd5fba 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -9,8 +9,8 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to
   enumerate domain computers for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 ScriptBlockText = "*[adsisearcher]*" AND ScriptBlockText = "*objectclass=computer*"
-  AND ScriptBlockText IN ("*.findAll()*","*.findOne()*") | stats count min(_time) as firstTime max(_time) as
+search: '`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectclass=computer*"
+  AND ScriptBlockText IN ("*findAll()*","*findOne()*") | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `remote_system_discovery_with_adsisearcher_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable

From ea3eac483b4153ee3d5f475b0961d386c3a93005 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Wed, 29 Jun 2022 13:45:17 -0700
Subject: [PATCH 48/48] Updating search string in a field from objectclass to
 objectcategory.

---
 .../endpoint/remote_system_discovery_with_adsisearcher.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
index c593bd5fba..3775197466 100644
--- a/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
+++ b/detections/endpoint/remote_system_discovery_with_adsisearcher.yml
@@ -9,7 +9,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the `[Adsisearcher]` type accelerator being used to query Active Directory
   for domain computers. Red Teams and adversaries may leverage `[Adsisearcher]` to
   enumerate domain computers for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectclass=computer*"
+search: '`powershell` EventCode=4104 ScriptBlockText = "*adsisearcher*" AND ScriptBlockText = "*objectcategory=computer*"
   AND ScriptBlockText IN ("*findAll()*","*findOne()*") | stats count min(_time) as firstTime max(_time) as
   lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `remote_system_discovery_with_adsisearcher_filter`'