diff --git a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml
index ec7fad0ee..6cb6b4dfd 100644
--- a/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml
+++ b/rules/windows/process_creation/sysmon_abusing_debug_privilege.yml
@@ -28,7 +28,7 @@ detection:
             - '\powershell.exe'
             - '\cmd.exe'
     selection3:
-            User: 'NT AUTHORITY\\SYSTEM'
+            User: 'NT AUTHORITY\SYSTEM'
     filter:
            CommandLine|contains|all:
            - ' route ADD '