diff --git a/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml b/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml
index 7c1fc3063..6fc70a361 100644
--- a/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml
+++ b/rules/windows/powershell/powershell_CL_Invocation_LOLScript.yml
@@ -19,18 +19,6 @@ detection:
         ScriptBlockText|contains|all:
           - 'CL_Invocation.ps1'
           - 'SyncInvoke'
-    selection2:
-        EventID: 4104
-        ScriptBlockText|contains:
-          - 'CL_Invocation.ps1'
-          - 'SyncInvoke'
-    timeframe: 1m
-    condition: 
-        - selection
-        - selection2 | count(ScriptBlockText) by Computer > 2
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1; SyncInvoke c:\Evil.exe
-      # or
-      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
-      # PS > SyncInvoke c:\Evil.exe
+    condition:  selection
 falsepositives: Unknown
-level: high
+level: high
\ No newline at end of file
diff --git a/rules/windows/powershell/powershell_CL_Invocation_LOLScript_v2.yml b/rules/windows/powershell/powershell_CL_Invocation_LOLScript_v2.yml
new file mode 100644
index 000000000..f85370f51
--- /dev/null
+++ b/rules/windows/powershell/powershell_CL_Invocation_LOLScript_v2.yml
@@ -0,0 +1,26 @@
+title: Execution via CL_Invocation.ps1
+id: 4cd29327-685a-460e-9dac-c3ab96e549dc
+description: Detects Execution via SyncInvoke in CL_Invocation.ps1 module
+status: experimental
+author: oscd.community, Natalia Shornikova
+date: 2020/10/14
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/Cl_invocation.yml
+    - https://twitter.com/bohops/status/948061991012327424
+tags:
+    - attack.defense_evasion
+    - attack.t1216
+logsource:
+    product: windows
+    service: powershell
+detection:
+    selection2:
+        EventID: 4104
+        ScriptBlockText|contains:
+          - 'CL_Invocation.ps1'
+          - 'SyncInvoke'
+    condition: selection2 | count(ScriptBlockText) by Computer > 2
+      # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
+      # PS > SyncInvoke c:\Evil.exe
+falsepositives: Unknown
+level: high
\ No newline at end of file