Slight correction. Process contains cmd line arguments for finding distinct number of sc invocations. Removing this and process id from BY clause

detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml

@@ -13,10 +13,10 @@ description: This detection targets behaviors observed when threat actors have u
   we see both an excessive number of sc.exe processes launched with specific commandline
   arguments to disable the start of certain services.
 search: '| tstats `security_content_summariesonly` distinct_count(Processes.process)
-  as distinct_cmdlines min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
+  as distinct_cmdlines values(Processes.process_id) as process_ids min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes
   WHERE Processes.process_name = "sc.exe" AND Processes.process="*start= disabled*"
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process
-  Processes.process_id Processes.parent_process_id, _time span=30m | where distinct_cmdlines >= 8
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_id,
+  _time span=30m | where distinct_cmdlines >= 8
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `excessive_number_of_service_control_start_as_disabled_filter`'
 how_to_implement: You must be ingesting data that records process activity from your