diff --git a/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml b/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml
index 69e6cf857..f6e9e1c00 100644
--- a/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml
+++ b/rules/windows/process_creation/proc_creation_win_susp_base64_cmdline_param.yml
@@ -4,6 +4,7 @@ status: experimental
 description: Detects programs that use base64 encoded values provided via command line, which is often an indicator of obfuscation but could also be used for legitimate purposes (e.g. if certain special characters would mess with the command line interface, enccrypted keys etc.)
 author: Florian Roth
 date: 2022/04/05
+modified: 2022/04/08
 references:
    - https://blog.malwarebytes.com/threat-intelligence/2022/04/new-uac-0056-activity-theres-a-go-elephant-in-the-room/d
 logsource:
@@ -13,7 +14,9 @@ detection:
    selection:
       - CommandLine|endswith: '=='
       - CommandLine|contains: '== -'
-   condition: selection
+   filter:
+      Image|endswith: '\VeeamAgent.exe'
+   condition: selection and not 1 of filter*
 falsepositives:
    - Legitimate software that uses base64 encoded values in its command line
 level: medium