Regex improvement on Powershell rules

rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml

@@ -30,7 +30,7 @@ detection:
     filter_main_host_application_null:
         # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
         # If you're already mapping and extracting the field, then obviously use that directly.
-        Data|re: 'HostId=[a-zA-Z0-9-]{36} EngineVersion='
+        Data|re: 'HostId=[a-zA-Z0-9-]{36}\r\n\tEngineVersion='
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown

rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml

@@ -31,7 +31,7 @@ detection:
     filter_main_host_application_null:
         # Note: Since we're using the raw data field to match. There is no easy way to filter out cases where the "HostApplication" field is null (i.e doesn't exist). We're practically forced to use a regex.
         # If you're already mapping and extracting the field, then obviously use that directly.
-        Data|re: 'HostId=[a-zA-Z0-9-]{36} EngineVersion='
+        Data|re: 'HostId=[a-zA-Z0-9-]{36}\r\n\tEngineVersion='
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown