Merge pull request #1989 from splunk/1962

Update powershell_remove_windows_defender_directory.yml

detections/endpoint/powershell_remove_windows_defender_directory.yml

@@ -11,7 +11,7 @@ description: This analytic will identify a suspicious PowerShell command used to
   campaign where it used Nirsofts advancedrun.exe to gain administrative privileges
   to then execute a PowerShell command to delete the Windows Defender folder. This
   is a good indicator the offending process is trying corrupt a Windows Defender installation.
-search: '`powershell` EventCode=4104 Message = "* rmdir *" OR Message = "*\\Microsoft\\Windows
+search: '`powershell` EventCode=4104 Message = "* rmdir *" AND Message = "*\\Microsoft\\Windows
   Defender*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
   Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `powershell_remove_windows_defender_directory_filter`'