From fcdd9de0063d972e6b099b1a3bf9211f10b36538 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Thu, 19 Aug 2021 09:56:23 -0400
Subject: [PATCH 1/7] Create active_directory_discovery.yml

---
 stories/active_directory_discovery.yml | 37 ++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 stories/active_directory_discovery.yml

diff --git a/stories/active_directory_discovery.yml b/stories/active_directory_discovery.yml
new file mode 100644
index 0000000000..b1b97923f7
--- /dev/null
+++ b/stories/active_directory_discovery.yml
@@ -0,0 +1,37 @@
+name: Active Directory Discovery
+id: 8460679c-2b21-463e-b381-b813417c32f2
+version: 1
+date: '2021-08-20'
+author: Mauricio Velazco, Splunk
+type: batch
+description: Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments.
+narrative: Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries 
+with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next. 
+
+Once an attacker obtains an initial foothold in an Active Directory environment, she is forced to engage in Discovery techniques in the initial phases of a breach to better
+understand and navigate the target network. Some examples include but are not limited to enumerating domain users, domain admins, computers, 
+domain controllers, network shares, group policy objects, domain trusts, etc.
+references:
+- https://attack.mitre.org/tactics/TA0007/
+- https://adsecurity.org/?p=2535
+- https://attack.mitre.org/techniques/T1087/001/
+- https://attack.mitre.org/techniques/T1087/002/
+- https://attack.mitre.org/techniques/T1087/003/
+- https://attack.mitre.org/techniques/T1482/
+- https://attack.mitre.org/techniques/T1201/
+- https://attack.mitre.org/techniques/T1069/001/
+- https://attack.mitre.org/techniques/T1069/002/
+- https://attack.mitre.org/techniques/T1018/
+- https://attack.mitre.org/techniques/T1049/
+- https://attack.mitre.org/techniques/T1033/
+
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
\ No newline at end of file

From 0974bde2fae4bc7b82f35fbd2714cf3ec8e658f3 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 24 Aug 2021 16:12:46 -0400
Subject: [PATCH 2/7] first batch of AD Disccovery detections

---
 .../endpoint/getlocaluser_with_powershell.yml | 53 +++++++++++++++++++
 ...localuser_with_powershell_script_block.yml | 49 +++++++++++++++++
 ...wmiobject_user_account_with_powershell.yml | 51 ++++++++++++++++++
 ...r_account_with_powershell_script_block.yml | 50 +++++++++++++++++
 .../local_account_discovery_with_net.yml      | 51 ++++++++++++++++++
 .../local_account_discovery_with_wmic.yml     | 51 ++++++++++++++++++
 stories/active_directory_discovery.yml        |  7 ++-
 .../getlocaluser_with_powershell.test.yml     | 12 +++++
 ...user_with_powershell_script_block.test.yml | 12 +++++
 ...ject_user_account_with_powershell.test.yml | 12 +++++
 ...ount_with_powershell_script_block.test.yml | 12 +++++
 .../local_account_discovery_with_net.test.yml | 12 +++++
 ...local_account_discovery_with_wmic.test.yml | 12 +++++
 13 files changed, 380 insertions(+), 4 deletions(-)
 create mode 100644 detections/endpoint/getlocaluser_with_powershell.yml
 create mode 100644 detections/endpoint/getlocaluser_with_powershell_script_block.yml
 create mode 100644 detections/endpoint/getwmiobject_user_account_with_powershell.yml
 create mode 100644 detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
 create mode 100644 detections/endpoint/local_account_discovery_with_net.yml
 create mode 100644 detections/endpoint/local_account_discovery_with_wmic.yml
 create mode 100644 tests/endpoint/getlocaluser_with_powershell.test.yml
 create mode 100644 tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
 create mode 100644 tests/endpoint/getwmiobject_user_account_with_powershell.test.yml
 create mode 100644 tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
 create mode 100644 tests/endpoint/local_account_discovery_with_net.test.yml
 create mode 100644 tests/endpoint/local_account_discovery_with_wmic.test.yml

diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
new file mode 100644
index 0000000000..bd79bc1c5d
--- /dev/null
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -0,0 +1,53 @@
+name: GetLocalUser with PowerShell
+id: 85fae8fa-0427-11ec-8b78-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: hunt
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users.  
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* 
+  AND Processes.process=*Win32_UserAccount*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  
\ No newline at end of file
diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
new file mode 100644
index 0000000000..888c67d9a1
--- /dev/null
+++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
@@ -0,0 +1,49 @@
+name: GetLocalUser with PowerShell Script Block
+id: 2e891cbe-0426-11ec-9c9c-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-LocalUser` commandlet. The `Get-LocalUser` commandlet is used to return a list of all local users. 
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*Get-LocalUser*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `getlocaluser_with_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
new file mode 100644
index 0000000000..b32305a054
--- /dev/null
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
@@ -0,0 +1,51 @@
+name: GetWmiObject User Account with PowerShell
+id: b44f6ac6-0429-11ec-87e9-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `powershell.exe` with command-line
+  arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users.  
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* OR Processes.process=*Win32_UserAccount*)
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
new file mode 100644
index 0000000000..0318fadfb3
--- /dev/null
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -0,0 +1,50 @@
+name: GetWmiObject User Account with PowerShell Script Block
+id: 640b0eda-0429-11ec-accd-acde48001122
+version: 1
+date: '2021-08-23'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used 
+  to return a list of all local users. 
+  Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
+search: 'powershell` EventCode=4104 Message IN (*Get-WmiObject*, *Win32_UserAccount*)
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon 
+  message: Local user discovery enumeration using PowerShell on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
new file mode 100644
index 0000000000..9248f3d385
--- /dev/null
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -0,0 +1,51 @@
+name: Local Account Discovery with Net
+id: 5d0d4830-0133-11ec-bae3-acde48001122
+version: 1
+date: '2021-08-19'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line
+  arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. 
+  Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") 
+  (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
new file mode 100644
index 0000000000..df0ac58dd1
--- /dev/null
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -0,0 +1,51 @@
+name: Local Account Discovery With Wmic
+id: 4902d7aa-0134-11ec-9d65-acde48001122
+version: 1
+date: '2021-08-19'
+author: Mauricio Velazco, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic looks for the execution of `wmic.exe` with command-line
+  arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. 
+  Red Teams and adversaries alike use net.exe to enumerate users for situational awareness and Active Directory Discovery.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") (Processes.process=*useraccount*) 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_wmic_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node.
+known_false_positives: Administrators or power users may use this command for troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1087/001/
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - UPDATE_DATASET_URL
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1087.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  security_domain: endpoint
+  impact: 30
+  confidence: 50
+  risk_score: 15
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  - Stage:Recon
+  message: Local user discovery enumeration on $dest$ by $user$
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
\ No newline at end of file
diff --git a/stories/active_directory_discovery.yml b/stories/active_directory_discovery.yml
index b1b97923f7..79db2e1060 100644
--- a/stories/active_directory_discovery.yml
+++ b/stories/active_directory_discovery.yml
@@ -5,12 +5,12 @@ date: '2021-08-20'
 author: Mauricio Velazco, Splunk
 type: batch
 description: Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments.
-narrative: Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries 
-with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next. 
+narrative: 'Discovery consists of techniques an adversay uses to gain knowledge about an internal environment or network. These techniques provide adversaries 
+with situational awareness and allows them to have the necessary information before deciding how to act or who/what to target next.\ 
 
 Once an attacker obtains an initial foothold in an Active Directory environment, she is forced to engage in Discovery techniques in the initial phases of a breach to better
 understand and navigate the target network. Some examples include but are not limited to enumerating domain users, domain admins, computers, 
-domain controllers, network shares, group policy objects, domain trusts, etc.
+domain controllers, network shares, group policy objects, domain trusts, etc.'
 references:
 - https://attack.mitre.org/tactics/TA0007/
 - https://adsecurity.org/?p=2535
@@ -24,7 +24,6 @@ references:
 - https://attack.mitre.org/techniques/T1018/
 - https://attack.mitre.org/techniques/T1049/
 - https://attack.mitre.org/techniques/T1033/
-
 tags:
   analytic_story:
   - Active Directory Discovery
diff --git a/tests/endpoint/getlocaluser_with_powershell.test.yml b/tests/endpoint/getlocaluser_with_powershell.test.yml
new file mode 100644
index 0000000000..a46db6d027
--- /dev/null
+++ b/tests/endpoint/getlocaluser_with_powershell.test.yml
@@ -0,0 +1,12 @@
+name: GetLocalUser with PowerShell Unit Test
+tests:
+- name: GetLocalUser with PowerShell
+  file: endpoint/getlocaluser_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
new file mode 100644
index 0000000000..c6ba159fde
--- /dev/null
+++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: GetLocalUser with PowerShell Script Block Unit Test
+tests:
+- name: GetLocalUser with PowerShell Script Block
+  file: endpoint/getlocaluser_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
diff --git a/tests/endpoint/getwmiobject_user_account_with_powershell.test.yml b/tests/endpoint/getwmiobject_user_account_with_powershell.test.yml
new file mode 100644
index 0000000000..819cb4b18d
--- /dev/null
+++ b/tests/endpoint/getwmiobject_user_account_with_powershell.test.yml
@@ -0,0 +1,12 @@
+name: GetWmiObject User Account with PowerShell Unit Test
+tests:
+- name: GetWmiObject User Account with PowerShell
+  file: endpoint/getwmiobject_user_account_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
diff --git a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
new file mode 100644
index 0000000000..dedf7dc621
--- /dev/null
+++ b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
@@ -0,0 +1,12 @@
+name: GetWmiObject User Account with PowerShell Script Block Unit Test
+tests:
+- name: GetWmiObject User Account with PowerShell Script Block
+  file: endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
diff --git a/tests/endpoint/local_account_discovery_with_net.test.yml b/tests/endpoint/local_account_discovery_with_net.test.yml
new file mode 100644
index 0000000000..d48423cd9f
--- /dev/null
+++ b/tests/endpoint/local_account_discovery_with_net.test.yml
@@ -0,0 +1,12 @@
+name: Local Account Discovery with Net Unit Test
+tests:
+- name: Local Account Discovery with Net
+  file: endpoint/local_account_discovery_with_net.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
diff --git a/tests/endpoint/local_account_discovery_with_wmic.test.yml b/tests/endpoint/local_account_discovery_with_wmic.test.yml
new file mode 100644
index 0000000000..353d1b5528
--- /dev/null
+++ b/tests/endpoint/local_account_discovery_with_wmic.test.yml
@@ -0,0 +1,12 @@
+name: Local Account Discovery With Wmic Unit Test
+tests:
+- name: Local Account Discovery With Wmic
+  file: endpoint/local_account_discovery_with_wmic.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: UPDATE_FILE_NAME
+    data: UPDATE_DATASET_URL
+    source: UPDATE_SPLUNK_SOURCE
+    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file

From 1158396c277a03ff7721c0deb25d52be5d17d489 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Tue, 24 Aug 2021 17:51:05 -0400
Subject: [PATCH 3/7] adding test dataset metadata

---
 detections/endpoint/getlocaluser_with_powershell.yml      | 2 +-
 .../getlocaluser_with_powershell_script_block.yml         | 2 +-
 .../getwmiobject_user_account_with_powershell.yml         | 2 +-
 ...miobject_user_account_with_powershell_script_block.yml | 2 +-
 detections/endpoint/local_account_discovery_with_net.yml  | 2 +-
 detections/endpoint/local_account_discovery_with_wmic.yml | 2 +-
 tests/endpoint/getlocaluser_with_powershell.test.yml      | 8 ++++----
 .../getlocaluser_with_powershell_script_block.test.yml    | 8 ++++----
 .../getwmiobject_user_account_with_powershell.test.yml    | 8 ++++----
 ...ect_user_account_with_powershell_script_block.test.yml | 8 ++++----
 tests/endpoint/local_account_discovery_with_net.test.yml  | 8 ++++----
 tests/endpoint/local_account_discovery_with_wmic.test.yml | 8 ++++----
 12 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index bd79bc1c5d..dbf3042702 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -25,7 +25,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   dataset:
-  - UPDATE_DATASET_URL
+   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
index 888c67d9a1..009100f1c8 100644
--- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml
+++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
@@ -22,7 +22,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
index b32305a054..59c1ed6c72 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
@@ -24,7 +24,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index 0318fadfb3..c218e3be83 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -23,7 +23,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
index 9248f3d385..e543af403f 100644
--- a/detections/endpoint/local_account_discovery_with_net.yml
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -24,7 +24,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
index df0ac58dd1..c1fe24cbe7 100644
--- a/detections/endpoint/local_account_discovery_with_wmic.yml
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -24,7 +24,7 @@ tags:
   analytic_story:
   - Active Directory Discovery
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
diff --git a/tests/endpoint/getlocaluser_with_powershell.test.yml b/tests/endpoint/getlocaluser_with_powershell.test.yml
index a46db6d027..a2b7ae4e89 100644
--- a/tests/endpoint/getlocaluser_with_powershell.test.yml
+++ b/tests/endpoint/getlocaluser_with_powershell.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
index c6ba159fde..5e96027046 100644
--- a/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getlocaluser_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file
diff --git a/tests/endpoint/getwmiobject_user_account_with_powershell.test.yml b/tests/endpoint/getwmiobject_user_account_with_powershell.test.yml
index 819cb4b18d..c7940893bc 100644
--- a/tests/endpoint/getwmiobject_user_account_with_powershell.test.yml
+++ b/tests/endpoint/getwmiobject_user_account_with_powershell.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
index dedf7dc621..8ed5fc6046 100644
--- a/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
+++ b/tests/endpoint/getwmiobject_user_account_with_powershell_script_block.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog
\ No newline at end of file
diff --git a/tests/endpoint/local_account_discovery_with_net.test.yml b/tests/endpoint/local_account_discovery_with_net.test.yml
index d48423cd9f..4f69526791 100644
--- a/tests/endpoint/local_account_discovery_with_net.test.yml
+++ b/tests/endpoint/local_account_discovery_with_net.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/local_account_discovery_with_wmic.test.yml b/tests/endpoint/local_account_discovery_with_wmic.test.yml
index 353d1b5528..b4c7736c70 100644
--- a/tests/endpoint/local_account_discovery_with_wmic.test.yml
+++ b/tests/endpoint/local_account_discovery_with_wmic.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From 0d21523ff1c1693bb01f047e24e371be169da77d Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Wed, 25 Aug 2021 11:38:28 -0400
Subject: [PATCH 4/7] correcting analytic type

---
 detections/endpoint/getlocaluser_with_powershell.yml          | 2 +-
 .../endpoint/getlocaluser_with_powershell_script_block.yml    | 2 +-
 .../endpoint/getwmiobject_user_account_with_powershell.yml    | 4 ++--
 ...getwmiobject_user_account_with_powershell_script_block.yml | 2 +-
 detections/endpoint/local_account_discovery_with_net.yml      | 2 +-
 detections/endpoint/local_account_discovery_with_wmic.yml     | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index dbf3042702..f7ae34c792 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -3,7 +3,7 @@ id: 85fae8fa-0427-11ec-8b78-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: hunt
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
diff --git a/detections/endpoint/getlocaluser_with_powershell_script_block.yml b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
index 009100f1c8..d9089f5c7c 100644
--- a/detections/endpoint/getlocaluser_with_powershell_script_block.yml
+++ b/detections/endpoint/getlocaluser_with_powershell_script_block.yml
@@ -3,7 +3,7 @@ id: 2e891cbe-0426-11ec-9c9c-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
index 59c1ed6c72..9be91277a6 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml
@@ -3,14 +3,14 @@ id: b44f6ac6-0429-11ec-87e9-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `powershell.exe` with command-line
   arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users.  
   Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* OR Processes.process=*Win32_UserAccount*)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* AND Processes.process=*Win32_UserAccount*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_user_account_with_powershell_filter`'
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index c218e3be83..b6fb731671 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -3,7 +3,7 @@ id: 640b0eda-0429-11ec-accd-acde48001122
 version: 1
 date: '2021-08-23'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml
index e543af403f..505ad8b723 100644
--- a/detections/endpoint/local_account_discovery_with_net.yml
+++ b/detections/endpoint/local_account_discovery_with_net.yml
@@ -3,7 +3,7 @@ id: 5d0d4830-0133-11ec-bae3-acde48001122
 version: 1
 date: '2021-08-19'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line
diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml
index c1fe24cbe7..58ad212ff3 100644
--- a/detections/endpoint/local_account_discovery_with_wmic.yml
+++ b/detections/endpoint/local_account_discovery_with_wmic.yml
@@ -3,7 +3,7 @@ id: 4902d7aa-0134-11ec-9d65-acde48001122
 version: 1
 date: '2021-08-19'
 author: Mauricio Velazco, Splunk
-type: batch
+type: Hunting
 datamodel:
 - Endpoint
 description: This analytic looks for the execution of `wmic.exe` with command-line

From 9bbcf96620869fa66d401a08ea1270a7de19f128 Mon Sep 17 00:00:00 2001
From: mvelazco <mauricio.velazco@gmail.com>
Date: Mon, 30 Aug 2021 13:32:51 -0400
Subject: [PATCH 5/7] minor fixes

---
 detections/endpoint/getlocaluser_with_powershell.yml           | 3 +--
 .../getwmiobject_user_account_with_powershell_script_block.yml | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index f7ae34c792..4eedb6de05 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -10,8 +10,7 @@ description: This analytic looks for the execution of `powershell.exe` with comm
   arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users.  
   Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-WmiObject* 
-  AND Processes.process=*Win32_UserAccount*)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") (Processes.process=*Get-LocalUser*)
   by Processes.dest Processes.user Processes.parent_process Processes.process_name
   Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getlocaluser_with_powershell_filter`'
diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index b6fb731671..d0a5b32693 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used 
   to return a list of all local users. 
   Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-search: 'powershell` EventCode=4104 Message IN (*Get-WmiObject*, *Win32_UserAccount*)
+search: 'powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable

From 237f346319b56c6db31859e10c1c15d026d8f484 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Wed, 1 Sep 2021 12:56:08 -0700
Subject: [PATCH 6/7] Update
 getwmiobject_user_account_with_powershell_script_block.yml

SPL Fix
---
 ...getwmiobject_user_account_with_powershell_script_block.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
index d0a5b32693..9b2e617be6 100644
--- a/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
+++ b/detections/endpoint/getwmiobject_user_account_with_powershell_script_block.yml
@@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev
   to identify the execution of the `Get-WmiObject` commandlet used with specific parameters. The `Win32_UserAccount` parameter is used 
   to return a list of all local users. 
   Red Teams and adversaries may leverage this commandlet to enumerate users for situational awareness and Active Directory Discovery.
-search: 'powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*")
+search: '`powershell` EventCode=4104 (Message="*Get-WmiObject*" AND Message="*Win32_UserAccount*")
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
   ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_user_account_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -47,4 +47,4 @@ tags:
   - name: dest
     type: Endpoint
     role:
-    - Victim
\ No newline at end of file
+    - Victim

From d344c7cda840e2d7f131ce43aab76b8198733a12 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Thu, 2 Sep 2021 08:50:28 -0700
Subject: [PATCH 7/7] Update getlocaluser_with_powershell.yml

---
 detections/endpoint/getlocaluser_with_powershell.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml
index 4eedb6de05..a04b654825 100644
--- a/detections/endpoint/getlocaluser_with_powershell.yml
+++ b/detections/endpoint/getlocaluser_with_powershell.yml
@@ -49,4 +49,6 @@ tags:
     type: Endpoint
     role:
     - Victim
-  
\ No newline at end of file
+  
+  
+