diff --git a/skills/detecting-fileless-malware-techniques/SKILL.md b/skills/detecting-fileless-malware-techniques/SKILL.md
index aec1a6c5..da372f0a 100644
--- a/skills/detecting-fileless-malware-techniques/SKILL.md
+++ b/skills/detecting-fileless-malware-techniques/SKILL.md
@@ -245,8 +245,9 @@ vol3 -f memory.dmp windows.vadinfo --pid 4012 | grep -i "PAGE_EXECUTE"
 # PowerShell CLR usage (indicates .NET reflection loading)
 vol3 -f memory.dmp windows.cmdline | grep -i "powershell"
 
-# Scan for known fileless frameworks (rule file avoids AV false positives on SKILL.md)
-vol3 -f memory.dmp yarascan.YaraScan --yara-file references/yara-fileless-powershell.yar
+# Scan for known fileless frameworks
+# YARA rule lives in references/yara-fileless-powershell.yar (kept separate to reduce AV false positives)
+vol3 -f memory.dmp yarascan.YaraScan --yara-file /path/to/yara-fileless-powershell.yar
 
 # Extract PowerShell command history from memory
 vol3 -f memory.dmp windows.cmdline