diff --git a/rules/windows/process_creation/win_susp_iss_module_install.yml b/rules/windows/process_creation/win_susp_iss_module_install.yml
index 28305f82e..79e0debe3 100644
--- a/rules/windows/process_creation/win_susp_iss_module_install.yml
+++ b/rules/windows/process_creation/win_susp_iss_module_install.yml
@@ -15,8 +15,8 @@ logsource:
     product: windows
 detection:
     selection:
-        CommandLine:
-            - '*\APPCMD.EXE install module /name:*'
+        CommandLine|contains:
+            - '\APPCMD.EXE install module /name:'
     condition: selection
 falsepositives:
     - Unknown as it may vary from organisation to arganisation how admins use to install IIS modules