From ee789a309ce8ed77e26331aae4daddc4b95041b9 Mon Sep 17 00:00:00 2001
From: Florian Roth <florian.roth@nextron-systems.com>
Date: Tue, 20 Oct 2020 13:11:10 +0200
Subject: [PATCH] fix: FP with expression

---
 .../powershell/powershell_nishang_malicious_commandlets.yml      | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rules/windows/powershell/powershell_nishang_malicious_commandlets.yml b/rules/windows/powershell/powershell_nishang_malicious_commandlets.yml
index c106426cc..0e6ca3972 100644
--- a/rules/windows/powershell/powershell_nishang_malicious_commandlets.yml
+++ b/rules/windows/powershell/powershell_nishang_malicious_commandlets.yml
@@ -75,7 +75,6 @@ detection:
         - TexttoExe
         - Powerpreter
         - Nishang
-        - EncodedData
         - DataToEncode
         - LoggedKeys
         - OUT-DNSTXT