diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
index 2132c89ba9..65df63e746 100644
--- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
+++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml
@@ -1,26 +1,25 @@
 name: AWS Create Policy Version to allow all resources
 id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4
-version: 2
-date: '2021-02-22'
+version: 3
+date: '2022-05-17'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel: []
-description: This search looks for AWS CloudTrail events where a user created a policy
-  version that allows them to access any resource in their account
+description: This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account.
 search: '`cloudtrail` eventName=CreatePolicyVersion eventSource = iam.amazonaws.com
   errorCode = success | spath input=requestParameters.policyDocument output=key_policy_statements
   path=Statement{} | mvexpand key_policy_statements | spath input=key_policy_statements
-  output=key_policy_action_1 path=Action | search key_policy_action_1 = "*" | stats
+  output=key_policy_action_1 path=Action | where key_policy_action_1 = "*" | stats
   count min(_time) as firstTime max(_time) as lastTime values(key_policy_statements)
   as policy_added by eventName eventSource aws_account_id errorCode userAgent eventID
-  awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
+  awsRegion user user_arn | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`|`aws_create_policy_version_to_allow_all_resources_filter`'
 how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
   search works with AWS CloudTrail logs.
 known_false_positives: While this search has no known false positives, it is possible
   that an AWS admin has legitimately created a policy to allow a user to access all
   resources. That said, AWS strongly advises against granting full control to all
-  AWS resources
+  AWS resources and you must verify this activity.
 references:
 - https://labs.bishopfox.com/tech-blog/privilege-escalation-in-aws
 - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/
@@ -41,8 +40,7 @@ tags:
   impact: 70
   kill_chain_phases:
   - Actions on Objectives
-  message: User $user$ created a policy version that allows them to access any resource
-    in their account
+  message: User $user$ created a policy version that allows them to access any resource in their account.
   mitre_attack_id:
   - T1078.004
   - T1078
@@ -64,6 +62,11 @@ tags:
   - eventName
   - userAgent
   - errorCode
+  - eventSource
   - requestParameters.userName
+  - requestParameters.policyDocument
+  - aws_account_id
+  - awsRegion
+  - eventID
   risk_score: 49
   security_domain: network
diff --git a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml
index 4a498b1b6b..9d4d9708d7 100644
--- a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml
+++ b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml
@@ -2,7 +2,7 @@ name: AWS Create Policy Version to allow all resources Unit Test
 tests:
 - name: AWS Create Policy Version to allow all resources
   file: cloud/aws_create_policy_version_to_allow_all_resources.yml
-  pass_condition: '| stats count | where count > 0'
+  pass_condition: '| stats count | where count = 1'
   earliest_time: -7d
   latest_time: now
   attack_data: