diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
index d834998fe7..d4ce4252da 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
@@ -1,7 +1,7 @@
 name: Potential Pass the Token or Hash Observed at the Destination Device
 id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
-version: 1
-date: '2021-09-01'
+version: 2
+date: '2021-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel: []
diff --git a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
index ca47f62d57..3430eca603 100644
--- a/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+++ b/detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
@@ -1,7 +1,7 @@
 name: Potential Pass the Token or Hash Observed by an Event Collecting Device
 id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
-version: 1
-date: '2021-09-01'
+version: 2
+date: '2021-11-05'
 author: Stanislav Miskovic, Splunk
 type: TTP
 datamodel: []