From 97580d4fa1c261acbed06e9b2a71bce25dad627f Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Sun, 12 Dec 2021 12:25:05 +0100
Subject: [PATCH] fix space

---
 .../powershell_ps_suspicious_local_group_reco.yml               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/powershell/powershell_script/powershell_ps_suspicious_local_group_reco.yml b/rules/windows/powershell/powershell_script/powershell_ps_suspicious_local_group_reco.yml
index 2061fc008..80a725b09 100644
--- a/rules/windows/powershell/powershell_script/powershell_ps_suspicious_local_group_reco.yml
+++ b/rules/windows/powershell/powershell_script/powershell_ps_suspicious_local_group_reco.yml
@@ -21,7 +21,7 @@ detection:
         ScriptBlockText|contains|all:
             - 'Get-WMIObject'
             - 'Win32_Group'
-    condition:  1 of test_*
+    condition: 1 of test_*
 falsepositives:
     - unknown
 level: low