diff --git a/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml b/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml
index a91d3bea2..3a4ec330b 100644
--- a/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml
+++ b/rules/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml
@@ -14,7 +14,7 @@ references:
     - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
 author: frack113
 date: 2023-01-13
-modified: 2023-12-15
+modified: 2025-08-28
 tags:
     - attack.defense-evasion
     - attack.t1112
@@ -24,7 +24,7 @@ logsource:
 detection:
     selection:
         CommandLine|contains|all:
-            - '\System\CurrentControlSet\Control\Lsa\'
+            - '\System\CurrentControlSet\Control\Lsa'
             - 'DisableRestrictedAdmin'
     condition: selection
 falsepositives: