From ce3b5cadfd16e2767cb4ce2724c2908df9ccc375 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 13 Sep 2021 12:08:42 -0400
Subject: [PATCH 01/10] initial 2 detections

---
 .../system_user_discovery_with_query.yml      | 50 +++++++++++++++++++
 .../system_user_discovery_with_whoami.yml     | 50 +++++++++++++++++++
 .../system_user_discovery_with_query.test.yml | 12 +++++
 ...system_user_discovery_with_whoami.test.yml | 12 +++++
 4 files changed, 124 insertions(+)
 create mode 100644 detections/endpoint/system_user_discovery_with_query.yml
 create mode 100644 detections/endpoint/system_user_discovery_with_whoami.yml
 create mode 100644 tests/endpoint/system_user_discovery_with_query.test.yml
 create mode 100644 tests/endpoint/system_user_discovery_with_whoami.test.yml

diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
new file mode 100644
index 0000000000..a9619bb04b
--- /dev/null
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -0,0 +1,50 @@
+name: System User Discovery With Query
+id: ad03bfcf-8a91-4bc2-a500-112993deba87
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. 
+  Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe") 
+  (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_query_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Remote system discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
new file mode 100644
index 0000000000..640041b5c0
--- /dev/null
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -0,0 +1,50 @@
+name: System User Discovery With Whoami
+id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user.
+  Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="whoami.exe") 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: System User discovery on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/system_user_discovery_with_query.test.yml b/tests/endpoint/system_user_discovery_with_query.test.yml
new file mode 100644
index 0000000000..ef1051246d
--- /dev/null
+++ b/tests/endpoint/system_user_discovery_with_query.test.yml
@@ -0,0 +1,12 @@
+name: System User Discovery With Query Unit Test
+tests:
+- name: System User Discovery With Query
+  file: endpoint/system_user_discovery_with_query.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/system_user_discovery_with_whoami.test.yml b/tests/endpoint/system_user_discovery_with_whoami.test.yml
new file mode 100644
index 0000000000..4e083ae9f4
--- /dev/null
+++ b/tests/endpoint/system_user_discovery_with_whoami.test.yml
@@ -0,0 +1,12 @@
+name: System User Discovery With Whoami Unit Test
+tests:
+- name: System User Discovery With Whoami
+  file: endpoint/system_user_discovery_with_whoami.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 687fb1745cc02c0af2738e5e4cee0dec2f7be82a Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 13 Sep 2021 17:22:30 -0400
Subject: [PATCH 02/10] adding 4 detections

---
 .../getcurrent_user_with_powershell.yml       | 52 +++++++++++++++++++
 ...rent_user_with_powershell_script_block.yml | 50 ++++++++++++++++++
 ...er_discocvery_with_env_vars_powershell.yml | 51 ++++++++++++++++++
 ..._with_env_vars_powershell_script_block.yml | 49 +++++++++++++++++
 .../getcurrent_user_with_powershell.test.yml  | 12 +++++
 ...user_with_powershell_script_block.test.yml | 12 +++++
 ...scocvery_with_env_vars_powershell.test.yml | 12 +++++
 ..._env_vars_powershell_script_block.test.yml | 12 +++++
 8 files changed, 250 insertions(+)
 create mode 100644 detections/endpoint/getcurrent_user_with_powershell.yml
 create mode 100644 detections/endpoint/getcurrent_user_with_powershell_script_block.yml
 create mode 100644 detections/endpoint/user_discocvery_with_env_vars_powershell.yml
 create mode 100644 detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
 create mode 100644 tests/endpoint/getcurrent_user_with_powershell.test.yml
 create mode 100644 tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml
 create mode 100644 tests/endpoint/user_discocvery_with_env_vars_powershell.test.yml
 create mode 100644 tests/endpoint/user_discovery_with_env_vars_powershell_script_block.test.yml

diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
new file mode 100644
index 0000000000..d4d08c1fa4
--- /dev/null
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -0,0 +1,52 @@
+name: GetCurrent User with PowerShell
+id: 7eb9c3d5-c98c-4088-acc5-8240bad15379
+version: 1
+date: '2021-08-25'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powerhsell.exe` with command-line
+  arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user.
+  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") 
+  (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*) 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Remote system discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
new file mode 100644
index 0000000000..aee325cdf5
--- /dev/null
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -0,0 +1,50 @@
+name: GetCurrent User with PowerShell Script Block
+id: 80879283-c30f-44f7-8471-d1381f6d437a
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user.
+  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*" AND Message = "*GetCurrent()*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `getcurrent_user_with_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+- https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Remote system discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
new file mode 100644
index 0000000000..29e57acff6
--- /dev/null
+++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
@@ -0,0 +1,51 @@
+name: User Discovery With Env Vars PowerShell
+id: 0cdf318b-a0dd-47d7-b257-c621c0247de8
+version: 1
+date: '2021-08-25'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments that leverage PowerShell environment variables to identify the current logged user.
+  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") 
+  (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Remote system discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
new file mode 100644
index 0000000000..c70b343ef9
--- /dev/null
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -0,0 +1,49 @@
+name: User Discovery With Env Vars PowerShell Script Block
+id: 77f41d9e-b8be-47e3-ab35-5776f5ec1d20
+version: 1
+date: '2021-09-13'
+author: Mauricio Velazco, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the use of PowerShell environment variables to identify the current logged user.
+  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1033/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1033
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Remote system discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/tests/endpoint/getcurrent_user_with_powershell.test.yml b/tests/endpoint/getcurrent_user_with_powershell.test.yml
new file mode 100644
index 0000000000..36f254a361
--- /dev/null
+++ b/tests/endpoint/getcurrent_user_with_powershell.test.yml
@@ -0,0 +1,12 @@
+name: GetCurrent User with PowerShell Unit Test
+tests:
+- name: GetCurrent User with PowerShell
+  file: endpoint/getcurrent_user_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml b/tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml
new file mode 100644
index 0000000000..2fdbad5df8
--- /dev/null
+++ b/tests/endpoint/getcurrent_user_with_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: GetCurrent User with PowerShell Script Block Unit Test
+tests:
+- name: GetCurrent User with PowerShell Script Block
+  file: endpoint/getcurrent_user_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file
diff --git a/tests/endpoint/user_discocvery_with_env_vars_powershell.test.yml b/tests/endpoint/user_discocvery_with_env_vars_powershell.test.yml
new file mode 100644
index 0000000000..7dfdeaa485
--- /dev/null
+++ b/tests/endpoint/user_discocvery_with_env_vars_powershell.test.yml
@@ -0,0 +1,12 @@
+name: User Discovery With Env Vars PowerShell Unit Test
+tests:
+- name: User Discovery With Env Vars PowerShell
+  file: endpoint/user_discocvery_with_env_vars_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/user_discovery_with_env_vars_powershell_script_block.test.yml b/tests/endpoint/user_discovery_with_env_vars_powershell_script_block.test.yml
new file mode 100644
index 0000000000..4efbc9196d
--- /dev/null
+++ b/tests/endpoint/user_discovery_with_env_vars_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: User Discovery With Env Vars PowerShell Script Block Unit Test
+tests:
+- name: User Discovery With Env Vars PowerShell Script Block
+  file: endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file

From 07e27ba6aefcfd1ac1dcd59eb852439f12940446 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-58-57>
Date: Mon, 13 Sep 2021 22:03:33 +0000
Subject: [PATCH 03/10] Added detection testing service results inSystem User
 Discovery With Query

---
 .../system_user_discovery_with_query.yml       | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index a9619bb04b..c7ee55bc66 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -6,13 +6,16 @@ author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. 
-  Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery.
+description: This analytic looks for the execution of `query.exe` with command-line
+  arguments utilized to discover the logged user. Red Teams and adversaries alike
+  may leverage `query.exe` to identify system users on a compromised endpoint for
+  situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe") 
-  (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_query_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="query.exe")
+  (Processes.process=*user*) by Processes.dest Processes.user Processes.parent_process
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `system_user_discovery_with_query_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
@@ -47,4 +50,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From e4719b9437c9d68d1aba2f0689a78e791257e9f5 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-59-138>
Date: Mon, 13 Sep 2021 22:56:08 +0000
Subject: [PATCH 04/10] Added detection testing service results inSystem User
 Discovery With Whoami

---
 .../endpoint/system_user_discovery_with_whoami.yml    | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
index 640041b5c0..b4d3a40577 100644
--- a/detections/endpoint/system_user_discovery_with_whoami.yml
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -6,10 +6,12 @@ author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user.
-  Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint for situational awareness and Active Directory Discovery.
+description: This analytic looks for the execution of `whoami.exe` without any arguments.
+  This windows native binary prints out the current logged user. Red Teams and adversaries
+  alike may leverage `whoami.exe` to identify system users on a compromised endpoint
+  for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="whoami.exe") 
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="whoami.exe")
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `system_user_discovery_with_whoami_filter`'
@@ -47,4 +49,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 137aa7a5e536a1c81aad852ef4f9617d299cdba6 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-42-127>
Date: Mon, 13 Sep 2021 22:58:57 +0000
Subject: [PATCH 05/10] Added detection testing service results inUser
 Discovery With Env Vars PowerShell Script Block

---
 ...scovery_with_env_vars_powershell_script_block.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index c70b343ef9..89b682f695 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -7,15 +7,18 @@ type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the use of PowerShell environment variables to identify the current logged user.
-  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
+  to identify the use of PowerShell environment variables to identify the current
+  logged user. Red Teams and adversaries may leverage this method to identify the
+  logged user on a compromised endpoint for situational awareness and Active Directory
+  Discovery.
 search: '`powershell` EventCode=4104 (Message = "*$env:UserName*" OR Message = "*[System.Environment]::UserName*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `user_discovery_with_env_vars_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
 tags:
@@ -46,4 +49,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From a51106c70db1abbf6e48ac0371aa4012a0f3628d Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-42-127>
Date: Mon, 13 Sep 2021 22:58:58 +0000
Subject: [PATCH 06/10] Added detection testing service results inUser
 Discovery With Env Vars PowerShell

---
 .../user_discocvery_with_env_vars_powershell.yml   | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
index 29e57acff6..5a2a59a1c7 100644
--- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
+++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
@@ -7,11 +7,14 @@ type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
-  arguments that leverage PowerShell environment variables to identify the current logged user.
-  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
+  arguments that leverage PowerShell environment variables to identify the current
+  logged user. Red Teams and adversaries may leverage this method to identify the
+  logged user on a compromised endpoint for situational awareness and Active Directory
+  Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") 
-  (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
+  (Processes.process="*$env:UserName*" OR Processes.process="*[System.Environment]::UserName*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `user_discovery_with_env_vars_powershell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
@@ -48,4 +51,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 4abb769c46522dc53d9d498475246a9a188eb8a5 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-149-103>
Date: Tue, 14 Sep 2021 13:33:53 +0000
Subject: [PATCH 07/10] Added detection testing service results inGetCurrent
 User with PowerShell

---
 .../endpoint/getcurrent_user_with_powershell.yml    | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
index d4d08c1fa4..f784213777 100644
--- a/detections/endpoint/getcurrent_user_with_powershell.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -7,11 +7,13 @@ type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powerhsell.exe` with command-line
-  arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user.
-  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
+  arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class.
+  This method returns an object that represents the current Windows user. Red Teams
+  and adversaries may leverage this method to identify the logged user on a compromised
+  endpoint for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") 
-  (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*) 
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe")
+  (Processes.process=*System.Security.Principal.WindowsIdentity* OR Processes.process=*GetCurrent()*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getcurrent_user_with_powershell_filter`'
@@ -49,4 +51,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 31a0177b31ef1059dea969b77d8ba8734b883594 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-82-231>
Date: Tue, 14 Sep 2021 13:35:28 +0000
Subject: [PATCH 08/10] Added detection testing service results inGetCurrent
 User with PowerShell Script Block

---
 ...rent_user_with_powershell_script_block.yml | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index aee325cdf5..666de1c51b 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -7,15 +7,19 @@ type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user.
-  Red Teams and adversaries may leverage this method to identify the logged user on a compromised endpoint for situational awareness and Active Directory Discovery.
-search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*" AND Message = "*GetCurrent()*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `getcurrent_user_with_powershell_script_block_filter`'
+  to identify the execution of the `GetCurrent` method of the WindowsIdentity .NET
+  class. This method returns an object that represents the current Windows user. Red
+  Teams and adversaries may leverage this method to identify the logged user on a
+  compromised endpoint for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*[System.Security.Principal.WindowsIdentity]*"
+  AND Message = "*GetCurrent()*") | stats count min(_time) as firstTime max(_time)
+  as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `getcurrent_user_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
   PowerShell Script Block Logging on some or all endpoints. Additional setup here
   https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+known_false_positives: Administrators or power users may use this PowerShell commandlet
+  for troubleshooting.
 references:
 - https://attack.mitre.org/techniques/T1033/
 - https://docs.microsoft.com/en-us/dotnet/api/system.security.principal.windowsidentity.getcurrent?view=net-5.0
@@ -47,4 +51,5 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim
+  automated_detection_testing: passed

From 379f8e82c17eea10ac141727d8e50098a55278e7 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 14 Sep 2021 10:01:52 -0400
Subject: [PATCH 09/10] adding required_fields

---
 .../endpoint/getcurrent_user_with_powershell.yml      | 11 +++++++++++
 .../getcurrent_user_with_powershell_script_block.yml  |  6 ++++++
 .../endpoint/system_user_discovery_with_query.yml     | 11 +++++++++++
 .../endpoint/system_user_discovery_with_whoami.yml    | 11 +++++++++++
 .../user_discocvery_with_env_vars_powershell.yml      | 11 +++++++++++
 ...iscovery_with_env_vars_powershell_script_block.yml |  6 ++++++
 6 files changed, 56 insertions(+)

diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
index d4d08c1fa4..9c349170cb 100644
--- a/detections/endpoint/getcurrent_user_with_powershell.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -36,6 +36,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   impact: 30
   confidence: 50
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index aee325cdf5..b66a5683e0 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -34,6 +34,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Path 
+  - Message
+  - OpCode 
+  - ComputerName 
+  - User
+  - EventCode
   security_domain: endpoint
   impact: 30
   confidence: 50
diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index a9619bb04b..de58f887a4 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -34,6 +34,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   impact: 30
   confidence: 50
diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
index 640041b5c0..93607356c3 100644
--- a/detections/endpoint/system_user_discovery_with_whoami.yml
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -34,6 +34,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   impact: 30
   confidence: 50
diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
index 29e57acff6..828196c9e2 100644
--- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
+++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
@@ -35,6 +35,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
   security_domain: endpoint
   impact: 30
   confidence: 50
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index c70b343ef9..502da75583 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -33,6 +33,12 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
+  - Path 
+  - Message
+  - OpCode 
+  - ComputerName 
+  - User
+  - EventCode
   security_domain: endpoint
   impact: 30
   confidence: 50

From 47e3c2bf9ea274c1fcb622028c85d71fc0fafdb9 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 14 Sep 2021 11:54:58 -0400
Subject: [PATCH 10/10] fixing message field

---
 detections/endpoint/getcurrent_user_with_powershell.yml       | 4 ++--
 .../endpoint/getcurrent_user_with_powershell_script_block.yml | 2 +-
 detections/endpoint/system_user_discovery_with_query.yml      | 2 +-
 detections/endpoint/system_user_discovery_with_whoami.yml     | 2 +-
 .../endpoint/user_discocvery_with_env_vars_powershell.yml     | 4 ++--
 .../user_discovery_with_env_vars_powershell_script_block.yml  | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml
index cd000955c7..9236646ef7 100644
--- a/detections/endpoint/getcurrent_user_with_powershell.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell.yml
@@ -1,7 +1,7 @@
 name: GetCurrent User with PowerShell
 id: 7eb9c3d5-c98c-4088-acc5-8240bad15379
 version: 1
-date: '2021-08-25'
+date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -57,7 +57,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: System user discovery on $dest$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
index 351693f0af..de78cecbf2 100644
--- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
+++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml
@@ -52,7 +52,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: System user discovery on $dest$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml
index 3673fc6a8c..61732a4940 100644
--- a/detections/endpoint/system_user_discovery_with_query.yml
+++ b/detections/endpoint/system_user_discovery_with_query.yml
@@ -56,7 +56,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: System user discovery on $dest$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml
index e95de5e38e..1468f68ac9 100644
--- a/detections/endpoint/system_user_discovery_with_whoami.yml
+++ b/detections/endpoint/system_user_discovery_with_whoami.yml
@@ -55,7 +55,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: System User discovery on $dest$ by $user$
+  message: System user discovery on $dest$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
index 2afc45bbc9..30978fc106 100644
--- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
+++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml
@@ -1,7 +1,7 @@
 name: User Discovery With Env Vars PowerShell
 id: 0cdf318b-a0dd-47d7-b257-c621c0247de8
 version: 1
-date: '2021-08-25'
+date: '2021-09-13'
 author: Mauricio Velazco, Splunk
 type: Hunting
 datamodel:
@@ -57,7 +57,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: System user discovery on $dest$
   observable:
   - name: dest
     type: Endpoint
diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
index fb2924d65f..9c0a7f0d1f 100644
--- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
+++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml
@@ -50,7 +50,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   - Stage:Recon
-  message: Remote system discovery enumeration on $dest$ by $user$
+  message: System user discovery on $dest$
   observable:
   - name: dest
     type: Endpoint