diff --git a/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml b/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml
index 7285cc243..a00956dad 100644
--- a/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml
+++ b/rules/windows/builtin/win_set_oabvirtualdirectory_externalurl.yml
@@ -13,15 +13,13 @@ logsource:
     product: windows
     service: msexchange-management
 detection:
-    keywords:
-      Message:
-        - "*Set-OabVirtualDirectory*"
-        - "*ExternalUrl*"
-        - "*Page_Load*"
-        - "*script*"
     selection:
-        EventID: 1
-    condition: keywords and selection
+        Message|contains|all:
+            - 'Set-OabVirtualDirectory'
+            - 'ExternalUrl'
+            - 'Page_Load'
+            - 'script'
+    condition: selection
 falsepositives:
     - Unknown
-level: high
\ No newline at end of file
+level: high