diff --git a/rules/windows/process_creation/win_service_execution.yml b/rules/windows/process_creation/win_service_execution.yml
index cf8fcfe3c..830e15fac 100644
--- a/rules/windows/process_creation/win_service_execution.yml
+++ b/rules/windows/process_creation/win_service_execution.yml
@@ -17,7 +17,7 @@ detection:
             - '*\net.exe'
             - '*\net1.exe'
         CommandLine|re: '.*start.*[a-zA-Z0-9]' # search for a service name after 'net start', avoiding intersection with "service discovery" technique detection rules
-    condition:  selection
+    condition: selection
 falsepositives:
     - Legitimate administrator or user executes a service for legitimate reason
 level: low