diff --git a/USAGE.md b/USAGE.md
index 6a4502cf57..cf78fe8383 100644
--- a/USAGE.md
+++ b/USAGE.md
@@ -232,11 +232,11 @@ def get_technique_users(src, tech_stix_id):
     software = [
         r.target_ref
         for r in src.relationships(tech_stix_id, 'uses', source_only=True)
-        if get_type_from_id(r.target_ref) in ['tool', 'malware']
+        if get_type_from_id(r.source_ref) in ['tool', 'malware']
     ]
 
     return src.query([
-        Filter('type', 'in', ['intrusion-set', 'malware', 'tools']),
+        Filter('type', 'in', ['intrusion-set', 'malware', 'tool']),
         Filter('id', 'in', groups + software)
     ], allow_custom=True)
     
@@ -289,4 +289,4 @@ def get_mitigations_by_technique(src, tech_stix_id):
 
 tech = get_technique_by_name(fs, 'Rundll32')[0]
 get_mitigations_by_technique(fs, tech.id)
-```
\ No newline at end of file
+```