diff --git a/rules/windows/builtin/win_alert_enable_weak_encryption.yml b/rules/windows/builtin/win_alert_enable_weak_encryption.yml
index 52df2d544..e9bd72c0d 100644
--- a/rules/windows/builtin/win_alert_enable_weak_encryption.yml
+++ b/rules/windows/builtin/win_alert_enable_weak_encryption.yml
@@ -1,23 +1,23 @@
 title: Detects Enabling of Weak Encryption and Kerberoast
 description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.
 reference: 
-	- https://adsecurity.org/?p=2053
-	- https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
+    - https://adsecurity.org/?p=2053
+    - https://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
 author: @neu5ron
 logsource:
-	product: windows
-	service: security
-	description: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'
+    product: windows
+    service: security
+    description: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management'
 detection:
-	selection:
-		EventID: 4738
-	keywords:
-		- 'DES'
-		- 'Preauth'
-		- 'Encrypted'
-	filters:
-		- 'Enabled'
-	condition: selection and keywords and filters
+    selection:
+        EventID: 4738
+    keywords:
+        - 'DES'
+        - 'Preauth'
+        - 'Encrypted'
+    filters:
+        - 'Enabled'
+    condition: selection and keywords and filters
 falsepositives: 
-	- Unknown
+    - Unknown
 level: high