diff --git a/rules/windows/process_creation/win_susp_ping_hex_ip.yml b/rules/windows/process_creation/win_susp_ping_hex_ip.yml
index 966ccfbfd..204c2b0ac 100644
--- a/rules/windows/process_creation/win_susp_ping_hex_ip.yml
+++ b/rules/windows/process_creation/win_susp_ping_hex_ip.yml
@@ -15,9 +15,9 @@ logsource:
     product: windows
 detection:
     selection:
-        CommandLine:
-            - '*\ping.exe 0x*'
-            - '*\ping 0x*'
+        CommandLine|contains:
+            - '\ping.exe 0x'
+            - '\ping 0x'
     condition: selection
 fields:
     - ParentCommandLine