diff --git a/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml b/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml
index 9957b6794..ea0a5b2fb 100644
--- a/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml
+++ b/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml
@@ -36,7 +36,7 @@ detection:
             - ' -d ' # Shortest possible version of the --data flag
             - ' --data '
     payloads:
-        CommandLine|contains:
+        - CommandLine|contains:
             - 'ToBase64String'
             - 'whoami'
             - 'nltest'
@@ -48,7 +48,7 @@ detection:
             - 'systeminfo'
             - 'tasklist'
             - 'sc query'
-        CommandLine|contains|all:
+        - CommandLine|contains|all:
             - 'type '
             - ' > '
             - ' C:\'