diff --git a/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml b/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml index 6e897ec73..d1902e7f8 100644 --- a/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml +++ b/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml @@ -19,7 +19,8 @@ detection: - 'del' - 'Remove-Item' - 'rm' - ScriptBlockText|contains|all: '(Get-PSReadlineOption).HistorySavePath' + ScriptBlockText|contains|all: + - '(Get-PSReadlineOption).HistorySavePath' selection_2: ScriptBlockText|contains|all: - 'Set-PSReadlineOption'