I want to block certain certutil commands from being executed through the BIOC Rule

[P.Madye]

Unable to get it why the below BIOC rule can't be added into the restrictions policy. I was trying to write a BIOC rule for monitoring dropped files via certutil. : 

dataset = xdr_data

| filter event_type = 2 and event_sub_type = ENUM.NETWORK_STREAM_CONNECT

| filter actor_process_image_name = "certutil.exe"

| filter (

os_actor_process_command_line ~= ".*-urlcache.*" or

os_actor_process_command_line ~= ".*-decode.*" or

os_actor_process_command_line ~= ".*-encode.*" )