diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index f7d2a8d1fd..6e8026e954 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -9,7 +9,7 @@ datamodel:
 description: This search looks for the creation of local administrator accounts using
   net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
-  user values(Processes.parent_process) as parent_process min(_time) as firstTime
+  user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
   OR Processes.process_name=net1.exe) AND Processes.process=*/add* AND (Processes.process=*administrators*
   OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR
diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml
index df1edaec4a..1e9d7c6d33 100644
--- a/detections/endpoint/delete_shadowcopy_with_powershell.yml
+++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml
@@ -42,7 +42,7 @@ tags:
   mitre_attack_id:
   - T1490
   observable:
-  - name: User
+  - name: UserID
     type: User
     role:
     - Victim
diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
index 61a46593c3..6371bc490e 100644
--- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
@@ -48,21 +48,17 @@ tags:
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: A suspicious powershell script contains base64 command in $Message$ with
-    EventCode $EventCode$ in host $ComputerName$
+  message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with
+    EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059
   - T1027
   - T1059.001
   observable:
-  - name: ComputerName
+  - name: Computer
     type: Hostname
     role:
     - Victim
-  - name: User
-    type: User
-    role:
-    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -73,7 +69,7 @@ tags:
   - Opcode
   - Computer
   - UserID
-  - EventCodes
+  - EventCode
   risk_score: 56
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
index 259310edec..8b33f20a1e 100644
--- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
+++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml
@@ -14,7 +14,7 @@ description: The following analytics uses Windows Event Id 7045, `New Service Wa
 search: ' `wineventlog_system` EventCode=7045  Service_File_Name = "*.exe" NOT (Service_File_Name
   IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*"))
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
-  Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
+  Service_Name Service_Start_Type Service_Type dest user | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the Service name, Service File Name Service Start type, and Service Type
@@ -46,6 +46,10 @@ tags:
   - T1569
   - T1569.002
   observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
   - name: Service_File_Name
     type: Other
     role:
@@ -65,6 +69,7 @@ tags:
   - _time
   - Service_Name
   - Service_Start_Type
+  - dest
   risk_score: 56
   security_domain: endpoint
   asset_type: Endpoint