diff --git a/rules/windows/process_creation/proc_creation_win_cl_mutexverifiers_lolscript.yml b/rules/windows/process_creation/proc_creation_win_cl_mutexverifiers_lolscript.yml
deleted file mode 100644
index 4fd2f44c7..000000000
--- a/rules/windows/process_creation/proc_creation_win_cl_mutexverifiers_lolscript.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-title: Execution via CL_Mutexverifiers.ps1
-id: 99465c8f-f102-4157-b11c-b0cddd53b79a
-description: Detects Execution via runAfterCancelProcess in CL_Mutexverifiers.ps1 module
-status: experimental
-author: oscd.community, Natalia Shornikova
-date: 2020/10/14
-modified: 2021/05/21
-references:
-    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSScripts/CL_mutexverifiers.yml
-    - https://twitter.com/pabraeken/status/995111125447577600
-tags:
-    - attack.defense_evasion
-    - attack.t1216
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection:
-      CommandLine|contains|all: 
-        - 'CL_Mutexverifiers.ps1'
-        - 'runAfterCancelProcess'
-      # Example Commandline: "powershell Import-Module c:\Windows\diagnostics\system\Audio\CL_Mutexverifiers.ps1; runAfterCancelProcess c:\Evil.exe"
-    condition: selection
-falsepositives:
- - Unknown
-level: high
diff --git a/rules/windows/process_creation/proc_creation_win_cl_invocation_lolscript.yml b/rules/windows/process_creation/proc_creation_win_lolbin_cl_invocation.yml
similarity index 100%
rename from rules/windows/process_creation/proc_creation_win_cl_invocation_lolscript.yml
rename to rules/windows/process_creation/proc_creation_win_lolbin_cl_invocation.yml