diff --git a/rules/windows/builtin/win_vul_cve_2020_0688.yml b/rules/windows/builtin/win_vul_cve_2020_0688.yml
index 20495c300..38b8e95e6 100644
--- a/rules/windows/builtin/win_vul_cve_2020_0688.yml
+++ b/rules/windows/builtin/win_vul_cve_2020_0688.yml
@@ -17,8 +17,8 @@ detection:
         EventID: 4
         Source: MSExchange Control Panel
         Level: Error
-    selection2|contains:
-      - '&__VIEWSTATE='
+    selection2:
+        - '*&__VIEWSTATE=*'
     condition: selection1 and selection2
 falsepositives:
     - Unknown