From 53827aa5caa451d57b4055f7d6bc8e6dc9fbdfe3 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 7 Sep 2021 15:52:08 -0600
Subject: [PATCH] Update get_domaintrust_with_powershell_script_block.yml

---
 .../endpoint/get_domaintrust_with_powershell_script_block.yml   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index f19d62afde..3eaa9a3d3d 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -10,7 +10,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. \
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 Message = "*get-domaintrust*" | stats count min(_time)
+search: '`powershell` EventCode=4104 Message="*get-domaintrust*" | stats count min(_time)
   as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.