diff --git a/rules/windows/process_creation/proc_creation_win_7zip_cve_2022_29072.yml b/rules/windows/process_creation/proc_creation_win_7zip_cve_2022_29072.yml
index 4ef6ffd6c..768061be9 100644
--- a/rules/windows/process_creation/proc_creation_win_7zip_cve_2022_29072.yml
+++ b/rules/windows/process_creation/proc_creation_win_7zip_cve_2022_29072.yml
@@ -7,6 +7,7 @@ references:
     - https://twitter.com/kagancapar/status/1515219358234161153
 author: frack113
 date: 2022/04/17
+modified: 2022/04/19
 tags:
     - cve.2022.29072
 logsource:
@@ -16,7 +17,9 @@ detection:
     selection: 
         Image|endswith: '\cmd.exe'
         ParentImage|endswith: '\7zFM.exe'
-    condition: selection
+    filter:
+        CommandLine|contains: ' /c '
+    condition: selection and not filter
 falsepositives:
     - Unknown
 level: high