Update defense_evasion_posh_obfuscation.toml

w0rk3r · w0rk3r · commit 5d93afca7c48 · 2025-12-01T16:21:52.000-03:00
diff --git a/rules/windows/defense_evasion_posh_obfuscation.toml b/rules/windows/defense_evasion_posh_obfuscation.toml
@@ -124,7 +124,7 @@ value = "?:\\\\Program Files\\\\WindowsPowerShell\\\\Modules\\\\*"
 negate = true
 [rule.filters.query.wildcard."file.directory"]
 case_insensitive = true
-value = "?:\\\\Program Files (x86)\\\\WindowsPowerShell\\\\Modules\\\\PowerShellGet\\\\*"
+value = "?:\\\\Program Files (x86)\\\\WindowsPowerShell\\\\Modules\\\\*"
 
 [[rule.filters]]
 [rule.filters.meta]
