Update SPL

detections/endpoint/windows_find_domain_organizational_units_with_getdomainou.yml

@@ -13,7 +13,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode=
   potentially aiding in lateral movement or privilege escalation strategies.
 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-DomainOU*" 
   | `windows_rename_to_cim`
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` 
   | `windows_find_domain_organizational_units_with_getdomainou_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs

detections/endpoint/windows_find_interesting_acl_with_findinterestingdomainacl.yml

@@ -14,7 +14,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode=
   Active Directory.
 search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-InterestingDomainAcl*" 
   | `windows_rename_to_cim`
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` 
   | `windows_find_interesting_acl_with_findinterestingdomainacl_filter`' 
 how_to_implement: The following Hunting analytic requires PowerShell operational logs

detections/endpoint/windows_forest_discovery_with_getforestdomain.yml

@@ -13,7 +13,7 @@ description: This analytic utilizes PowerShell Script Block Logging (EventCode=4
   Such information can provide attackers with a broader understanding of the domain structure and potential avenues for lateral movement or privilege escalation.
 search: '`powershell` EventCode=4104 ScriptBlockText = "*Get-ForestDomain*" 
   | `windows_rename_to_cim`
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user 
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` 
   | `windows_forest_discovery_with_getforestdomain_filter`'
 how_to_implement: The following Hunting analytic requires PowerShell operational logs

detections/endpoint/windows_get_local_admin_with_findlocaladminaccess.yml

@@ -13,7 +13,7 @@ description: This analytic leverages PowerShell Script Block Logging (EventCode=
   has local administrator access. Such information can provide attackers with potential targets for lateral movement or privilege escalation within the network.
 search: '`powershell` EventCode=4104 ScriptBlockText = "*Find-LocalAdminAccess*" 
   | `windows_rename_to_cim`
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID  
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText dest user 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)` 
   | `windows_get_local_admin_with_findlocaladminaccess_filter`'