diff --git a/rules/windows/process_creation/win_apt_cloudhopper.yml b/rules/windows/process_creation/win_apt_cloudhopper.yml
index 940696607..8c6538e18 100755
--- a/rules/windows/process_creation/win_apt_cloudhopper.yml
+++ b/rules/windows/process_creation/win_apt_cloudhopper.yml
@@ -16,7 +16,9 @@ logsource:
 detection:
     selection:
         Image|endswith: '\cscript.exe'
-        CommandLine|contains: '.vbs /shell '
+        CommandLine|contains|all:
+            - '.vbs'
+            - '/shell'
     condition: selection
 fields:
     - CommandLine