diff --git a/rules/windows/process_creation/proc_creation_win_iis_service_account_password_dumped.yml b/rules/windows/process_creation/proc_creation_win_iis_service_account_password_dumped.yml
index e4ec75500..9b49fdc66 100644
--- a/rules/windows/process_creation/proc_creation_win_iis_service_account_password_dumped.yml
+++ b/rules/windows/process_creation/proc_creation_win_iis_service_account_password_dumped.yml
@@ -32,7 +32,7 @@ detection:
             - ' /text '
             - ' /config '
             - ' /@c'
-    condition: 1 of selection_cmd* and selection_list
+    condition: all of selection_*
 falsepositives:
     - Unknown
 level: high