diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
index 87500782d1..aeb26bd70a 100644
--- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml
+++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml
@@ -10,7 +10,7 @@ description: This detection is to identify the abuse the Windows SC.exe to execu
   malicious commands or payloads via PowerShell.
 search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name)
   | regex l_Service_File_Name="powershell[.\s]|powershell_ise[.\s]|pwsh[.\s]|psexec[.\s]"
-  | regex l_Service_File_Name="-nop[rofile]*|-w[indowstyle]*\s+hid[den]*|-noe[xit]*|-enc[odedcommand]*"
+  | regex l_Service_File_Name="-nop[rofile\s]+|-w[indowstyle]*\s+hid[den]*|-noe[xit\s]+|-enc[odedcommand\s]+"
   | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name
   Service_Name Service_Start_Type Service_Type Service_Account user | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `malicious_powershell_executed_as_a_service_filter`'