diff --git a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml
index 399103d25..041bba07a 100644
--- a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml
+++ b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml
@@ -28,7 +28,9 @@ detection:
             - '\powershell.exe'
             - '\cmd.exe'
     selection3:
-            User: 'NT AUTHORITY\SYSTEM'
+            User|startswith: 
+                - 'NT AUTHORITY\SYSTEM'
+                - 'AUTORITE NT\Sys' # French language settings
     filter:
            CommandLine|contains|all:
            - ' route '