From e7da16d1334d60c6652da8ed4b4e57895ece290a Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Tue, 7 Sep 2021 15:30:42 -0600
Subject: [PATCH] fixes

---
 .../endpoint/get_domaintrust_with_powershell_script_block.yml   | 2 +-
 .../endpoint/get_foresttrust_with_powershell_script_block.yml   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
index 8d120a67da..f19d62afde 100644
--- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml
@@ -11,7 +11,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 Message = "*get-domaintrust*" | stats count min(_time)
-  as firstTime max(_time) as lastTime by Path Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)`
+  as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domaintrust_with_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: It is possible certain system management frameworks utilize this command to gather trust information.
diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
index ff5e6c9465..910c748b78 100644
--- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
+++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml
@@ -12,7 +12,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
 
   During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 Message = "*get-foresttrust*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by  Path Message OpCode ComputerName User EventCode
+  | stats count min(_time) as firstTime max(_time) as lastTime by  Message OpCode ComputerName User EventCode
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` 
   | `get_foresttrust_with_powershell_script_block_filter`'