From 83451b3e6d53685efe0b78044ee528adb17c44cf Mon Sep 17 00:00:00 2001
From: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
Date: Thu, 4 Aug 2022 10:58:56 +0100
Subject: [PATCH] Update proc_creation_win_exfil_data_via_cli.yml

---
 .../process_creation/proc_creation_win_exfil_data_via_cli.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml b/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml
index 9957b6794..ea0a5b2fb 100644
--- a/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml
+++ b/rules/windows/process_creation/proc_creation_win_exfil_data_via_cli.yml
@@ -36,7 +36,7 @@ detection:
             - ' -d ' # Shortest possible version of the --data flag
             - ' --data '
     payloads:
-        CommandLine|contains:
+        - CommandLine|contains:
             - 'ToBase64String'
             - 'whoami'
             - 'nltest'
@@ -48,7 +48,7 @@ detection:
             - 'systeminfo'
             - 'tasklist'
             - 'sc query'
-        CommandLine|contains|all:
+        - CommandLine|contains|all:
             - 'type '
             - ' > '
             - ' C:\'