diff --git a/detections/sc_manipulating_services.json b/detections/sc_manipulating_services.json
index 3e8f8d54b5..7bf84b435a 100644
--- a/detections/sc_manipulating_services.json
+++ b/detections/sc_manipulating_services.json
@@ -84,7 +84,7 @@
     "earliest_time": "-70m@m",
     "latest_time": "-10m@m"
   },
-  "search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe Processes.process=\"* create *\" Processes.process=\"* config *\" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`",
+  "search": "| tstats `summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process=\"* create *\" OR Processes.process=\"* config *\") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)`",
   "search_description": "This search looks for arguments to sc.exe indicating the creation or modification of a Windows service.",
   "search_id": "f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d",
   "search_name": "Sc.exe Manipulating Windows Services",
diff --git a/detections/wmi_process_launch.json b/detections/wmi_process_launch.json
index 47145fcfc2..7de087e7a9 100644
--- a/detections/wmi_process_launch.json
+++ b/detections/wmi_process_launch.json
@@ -77,7 +77,7 @@
     "earliest_time": "-70m@m",
     "latest_time": "-10m@m"
   },
-  "search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name = \"scrcons.exe\" by Processes.user Processes.dest Processes.process_name  | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`",
+  "search": "| tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.parent_process_name = *WmiPrvSE.exe by Processes.user Processes.dest Processes.process_name  | `drop_dm_object_name(\"Processes\")` | `ctime(firstTime)`| `ctime(lastTime)`",
   "search_description": "This search looks for processes launched via WMI.",
   "search_id": "24869767-8579-485d-9a4f-d9ddfd8f0cac",
   "search_name": "Process Execution via WMI",