From 1ebd75754fa5a3d2bc125138212cbbd0633546cb Mon Sep 17 00:00:00 2001
From: Tim Shelton <tshelton@hawkdefense.com>
Date: Wed, 1 Dec 2021 21:15:41 +0000
Subject: [PATCH] omgosh fix err in syntax on this.... sooo sorry!

---
 .../powershell_script/powershell_malicious_commandlets.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/powershell/powershell_script/powershell_malicious_commandlets.yml b/rules/windows/powershell/powershell_script/powershell_malicious_commandlets.yml
index 7632b7a8c..5491b7ab9 100644
--- a/rules/windows/powershell/powershell_script/powershell_malicious_commandlets.yml
+++ b/rules/windows/powershell/powershell_script/powershell_malicious_commandlets.yml
@@ -115,7 +115,7 @@ detection:
             - "Invoke-AllChecks"
     false_positives:
         ScriptBlockText|contains: Get-SystemDriveInfo  # http://bheltborg.dk/Windows/WinSxS/amd64_microsoft-windows-maintenancediagnostic_31bf3856ad364e35_10.0.10240.16384_none_91ef7543a4514b5e/CL_Utility.ps1
-        ScriptBlockText:contains: C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Scripts\Set-Wallpaper.ps1  # false positive form Amazon EC2
+        ScriptBlockText|contains: C:\ProgramData\Amazon\EC2-Windows\Launch\Module\Scripts\Set-Wallpaper.ps1  # false positive form Amazon EC2
     condition: select_Malicious and not false_positives
 falsepositives:
     - Penetration testing