From 080e8d3f14760fb5a9e36449e739e6640e4474ee Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Wed, 8 Sep 2021 08:16:57 -0600
Subject: [PATCH] Update create_or_delete_windows_shares_using_net_exe.yml

Fixing up query, related to #1636
---
 ...eate_or_delete_windows_shares_using_net_exe.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
index fd79a29901..3bb1d3b0cf 100644
--- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
@@ -8,12 +8,14 @@ datamodel:
 - Endpoint
 description: This search looks for the creation or deletion of hidden shares using
   net.exe.
-search: '| tstats `security_content_summariesonly` count values(Processes.user) as
-  user values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe
-  OR Processes.process_name=net1.exe) by Processes.process Processes.process_name
-  Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processs.process_name=net.exe OR Processes.process_name=net1.exe)
+  AND (Processes.process="* share *") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `create_or_delete_windows_shares_using_net_exe_filter`'
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.