diff --git a/Tactics/CredentialAccess.md b/Tactics/CredentialAccess.md
index 914c319..2408126 100644
--- a/Tactics/CredentialAccess.md
+++ b/Tactics/CredentialAccess.md
@@ -55,11 +55,7 @@ Atomics: [T1552.006](https://github.com/redcanaryco/atomic-red-team/blob/master/
 Detection focuses on sysvol GP Policy xml file enumeration, with findstr or Get-GPPPassword (Alias or CmdScript internal match).
 
 `
-TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR
-
-TgtProcCmdline ContainsCIS "Get-GPPPassword" OR
-
-SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'"
+TgtProcCmdline RegExp "^.*\/S cpassword.*\\sysvol\\.*.xml" OR TgtProcCmdline ContainsCIS "Get-GPPPassword" OR SrcProcCmdScript ContainsCIS "Get-ChildItem -Path \"\\$Server\SYSVOL\" -Recurse -ErrorAction SilentlyContinue -Include 'Groups.xml','Services.xml','Scheduledtasks.xml','DataSources.xml','Printers.xml','Drives.xml'"
 `
 
 ### T1558.003 Kerberoasting