diff --git a/rules/windows/image_load/sysmon_susp_office_dotnet_assembly_dll_load.yml b/rules/windows/image_load/sysmon_susp_office_dotnet_assembly_dll_load.yml
index 7e70aed3b..c9d881196 100755
--- a/rules/windows/image_load/sysmon_susp_office_dotnet_assembly_dll_load.yml
+++ b/rules/windows/image_load/sysmon_susp_office_dotnet_assembly_dll_load.yml
@@ -22,7 +22,7 @@ detection:
             - '\excel.exe'
             - '\outlook.exe'
         ImageLoaded|startswith:
-            - 'C:\Windows\assembly\\'
+            - 'C:\Windows\assembly\'
     condition: selection
 falsepositives:
     - Alerts on legitimate macro usage as well, will need to filter as appropriate