diff --git a/host-interaction/console/manipulate-console.yml b/host-interaction/console/manipulate-console.yml
index f6abf885..464d2ae6 100644
--- a/host-interaction/console/manipulate-console.yml
+++ b/host-interaction/console/manipulate-console.yml
@@ -9,12 +9,14 @@ rule:
     examples:
       - 3aa7ee4d67f562933bc998f352b1f319:0x705413A0
   features:
-    - or:
-      - api: kernel32.SetConsoleCursorPosition
-      - api: kernel32.ReadConsoleOutputCharacter
-      - api: kernel32.WriteConsoleOutputCharacter
-      - api: kernel32.WriteConsoleOutput
-      - api: kernel32.WriteConsoleInput
+    - and:
+      - or:
+        - api: kernel32.SetConsoleCursorPosition
+        - api: kernel32.ReadConsoleOutputCharacter
+        - api: kernel32.WriteConsoleOutputCharacter
+        - api: kernel32.WriteConsoleOutput
+        - api: kernel32.WriteConsoleInput
+      # see https://github.com/fireeye/capa/issues/348
       - optional:
         - api: kernel32.GetStdHandle
         - number: 0xfffffff5 = STD_OUTPUT_HANDLE