diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index 0357309fdb..a7787fbacc 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -11,7 +11,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 Message="*get-domaintrust*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by Message ComputerName EventCode 
+  | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode 
   | `security_content_ctime(firstTime)` 
   | `security_content_ctime(lastTime)`
   | `get_domaintrust_with_powershell_script_block_filter`'