diff --git a/rules/windows/process_creation/proc_creation_win_susp_tracker_execution.yml b/rules/windows/process_creation/proc_creation_win_susp_tracker_execution.yml
index 46bef1bd6..aaecb1564 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_tracker_execution.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_tracker_execution.yml
@@ -6,7 +6,7 @@ references:
     - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
 author: 'Avneet Singh @v3t0_, oscd.community'
 date: 2020/10/18
-modified: 2022/11/12
+modified: 2023/01/06
 tags:
     - attack.defense_evasion
     - attack.t1055.001
@@ -28,7 +28,9 @@ detection:
         #   GrandparentImage: C:\Program Files\Microsoft Visual Studio\2022\Community\Msbuild\Current\Bin\MSBuild.exe
         #   ParentCommandLine: "C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\MSBuild.exe" /nologo /nodemode:1 /nodeReuse:true /low:false
         #   CommandLine: "C:\Program Files\Microsoft Visual Studio\2022\Community\MSBuild\Current\Bin\Tracker.exe" @"C:\Users\user\AppData\Local\Temp\tmp05c7789bc5534838bf96d7a0fed1ffff.tmp" /c "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.29.30133\bin\HostX86\x64\Lib.exe"
-        ParentImage|endswith: '\Msbuild\Current\Bin\MSBuild.exe'
+        ParentImage|endswith: 
+            - '\Msbuild\Current\Bin\MSBuild.exe'
+            - '\Msbuild\Current\Bin\amd64\MSBuild.exe'
         CommandLine|contains|all:
             - '\VC\Tools\MSVC\'
             - '\bin\HostX86\x64\'