diff --git a/rules/windows/builtin/win_alert_mimikatz_keywords.yml b/rules/windows/builtin/win_alert_mimikatz_keywords.yml
index e352a76cb..41dbb1913 100644
--- a/rules/windows/builtin/win_alert_mimikatz_keywords.yml
+++ b/rules/windows/builtin/win_alert_mimikatz_keywords.yml
@@ -33,7 +33,7 @@ detection:
         - ' s::l '
         - 'gentilkiwi.com'
         - 'Kiwi Legit Printer'
-                - 'sekurlsa::logonpasswords'
+        - 'sekurlsa::logonpasswords'
         - 'crypto::capi'
         - 'crypto::certificates'
         - 'crypto::certtohw'