Update sysmon_long_powershell_commandline.yml

rules/windows/process_creation/sysmon_long_powershell_commandline.yml

@@ -1,5 +1,5 @@
 title: Too Long PowerShell Commandlines
-id: 3f07b9d1-2082-4c56-9277-613a621983cc
+id: d0d28567-4b9a-45e2-8bbc-fb1b66a1f7f6
 description: Detects Too long PowerShell command lines
 references:
     - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
@@ -14,13 +14,13 @@ logsource:
     product: windows
 detection:
     Powershell_selection:
-      - CommandLine: 
-        - '*powershell*'
-        - '*pwsh*'
+      - CommandLine|contains: 
+        - 'powershell'
+        - 'pwsh'
       - Description: 'Windows Powershell'
       - Product: 'PowerShell Core 6'
-    Length_selection|re:
-      CommandLine: '(.){1000,}'
+    Length_selection:
+      CommandLine|re: '(.){1000,}'
     condition: all of them
 falsepositives: Unknown
 level: medium