diff --git a/splunk-magic-hound.txt b/splunk-magic-hound.md
similarity index 99%
rename from splunk-magic-hound.txt
rename to splunk-magic-hound.md
index 75b6201..1e6899a 100644
--- a/splunk-magic-hound.txt
+++ b/splunk-magic-hound.md
@@ -1,4 +1,6 @@
 ```check against powershell /c "Get-PhysicalDisk | Select-Object DeviceID, MediaType, Size, FriendlyName"```
+
+```
 `indextime` (`sysmon` OR `windows`) AND "powershell /c "Get-PhysicalDisk"
 | eval hash_sha256= lower(hash_sha256),
 hunting_trigger="Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.",
@@ -19,6 +21,7 @@ priority=""
 | convert ctime(indextime) 
 | table _time indextime event_description hash_sha256 host_fqdn user_name original_file_name process_path process_guid process_parent_path process_id process_parent_id process_command_line process_parent_command_line process_parent_guid mitre_category mitre_technique mitre_technique_id hunting_trigger mitre_subtechnique mitre_subtechnique_id apt mitre_link creator upload_date last_modify_date mitre_version priority
 | collect `jarvis_index`
+```
 
 `indextime` (`sysmon` OR `windows`) AND ('powershell.exe /c "Set-MpPreference -DisableRealtimeMonitoring $true"' OR 'powershell.exe /c "Set-Service -Name windefend -StartupType Disabled"' OR 'powershell.exe /c "Stop-Service -Name windefend"')
 | eval hash_sha256= lower(hash_sha256),