diff --git a/rules/windows/powershell/powershell_cmdline_specific_comb_methods.yml b/rules/windows/powershell/powershell_cmdline_specific_comb_methods.yml index ba081b2f5..79ae6fbe9 100644 --- a/rules/windows/powershell/powershell_cmdline_specific_comb_methods.yml +++ b/rules/windows/powershell/powershell_cmdline_specific_comb_methods.yml @@ -31,17 +31,13 @@ detection: - 'ToString' - 'String' selection4: - CommandLine|contains|all: - - 'split' - - 'join' - selection5: CommandLine|contains|all: - 'ForEach' - 'Xor' - selection6: + selection5: CommandLine|contains: - 'cOnvErTTO-SECUreStRIng' - condition: selection1 and ((selection2 and selection3) or selection4 or selection5 or selection5) + condition: selection1 and ((selection2 and selection3) or selection4 or selection5) falsepositives: - Unlikely level: high