diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml
index 5c2276390f..b0a79677d4 100644
--- a/detections/cloud/aws_createaccesskey.yml
+++ b/detections/cloud/aws_createaccesskey.yml
@@ -1,7 +1,7 @@
 name: AWS CreateAccessKey
 id: 2a9b80d3-6340-4345-11ad-212bf3d0d111
-version: 2
-date: '2021-07-19'
+version: 3
+date: '2022-03-03'
 author: Bhavin Patel, Splunk
 type: Hunting
 datamodel: []
@@ -9,11 +9,16 @@ description: This search looks for AWS CloudTrail events where a user A who has
   permission to create access keys, makes an API call to create access keys for another
   user B. Attackers have been know to use this technique for Privilege Escalation
   in case new victim(user B) has more permissions than old victim(user B)
-search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com
-  errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats
-  count min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName
-  src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
-  user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_createaccesskey_filter`'
+search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success 
+  | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0)
+  | search match=0
+  | stats
+    count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
+    src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId
+    user_arn 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  |`aws_createaccesskey_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml
index 0c7fd9c7b2..bb8525ded2 100644
--- a/detections/cloud/aws_updateloginprofile.yml
+++ b/detections/cloud/aws_updateloginprofile.yml
@@ -1,7 +1,7 @@
 name: AWS UpdateLoginProfile
 id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111
-version: 2
-date: '2021-07-19'
+version: 3
+date: '2022-03-03'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel: []
@@ -9,11 +9,16 @@ description: This search looks for AWS CloudTrail events where a user A who has
   permission to update login profile, makes an API call to update login profile for
   another user B . Attackers have been know to use this technique for Privilege Escalation
   in case new victim(user B) has more permissions than old victim(user B)
-search: '`cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com
-  errorCode = success| search userIdentity.userName!=requestParameters.userName  |  stats
-  count min(_time) as firstTime max(_time) as lastTime  by requestParameters.userName
+search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success 
+  | eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) 
+  | search match=0 
+  | stats
+  count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName
   src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName
-  user_arn | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|`aws_updateloginprofile_filter`'
+  user_arn 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `aws_updateloginprofile_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible