diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index f4f77211..ee63dd51 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -5206,7 +5206,7 @@ credential-access:
         domain:
           description: Domain FQDN
           type: String
-          default: contoso.com
+          default: "$env:UserDnsDomain"
         auth:
           description: authentication method to choose between "NTLM" and "Kerberos"
           type: String
diff --git a/atomics/T1110.003/T1110.003.md b/atomics/T1110.003/T1110.003.md
index 69507fd4..1d6d21bd 100644
--- a/atomics/T1110.003/T1110.003.md
+++ b/atomics/T1110.003/T1110.003.md
@@ -136,7 +136,7 @@ Prerequisite: AD RSAT PowerShell module is needed and it must run under a domain
 | Name | Description | Type | Default Value |
 |------|-------------|------|---------------|
 | password | single password we will attempt to auth with (if you need several passwords, then it is a bruteforce so see T1110.001) | String | P@ssw0rd!|
-| domain | Domain FQDN | String | contoso.com|
+| domain | Domain FQDN | String | $env:UserDnsDomain|
 | auth | authentication method to choose between "NTLM" and "Kerberos" | String | NTLM|