From 1aa7697ca807cd520533307f83a0ef59e02a95c3 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Thu, 27 Jan 2022 16:16:57 +0100
Subject: [PATCH] Update posh_ps_clear_powershell_history.yml

---
 .../powershell_script/posh_ps_clear_powershell_history.yml     | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml b/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml
index 6e897ec73..d1902e7f8 100644
--- a/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml
+++ b/rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml
@@ -19,7 +19,8 @@ detection:
             - 'del'
             - 'Remove-Item'
             - 'rm'
-        ScriptBlockText|contains|all: '(Get-PSReadlineOption).HistorySavePath'
+        ScriptBlockText|contains|all: 
+            - '(Get-PSReadlineOption).HistorySavePath'
     selection_2:
         ScriptBlockText|contains|all:
             - 'Set-PSReadlineOption'