Detection Rule logic fails to work as expected