diff --git a/rules/windows/process_creation/win_susp_splwow64.yml b/rules/windows/process_creation/win_susp_splwow64.yml
index 3695fcec2..38c4a4da3 100644
--- a/rules/windows/process_creation/win_susp_splwow64.yml
+++ b/rules/windows/process_creation/win_susp_splwow64.yml
@@ -13,7 +13,7 @@ detection:
     selection:
         Image|endswith: '\splwow64.exe'
     filter:
-        CommandLine|contains: 'splwow64.exe '
+        CommandLine|endswith: 'splwow64.exe'
     condition: selection and not filter
 falsepositives:
     - Unknown