diff --git a/rules/windows/process_creation/win_susp_rundll32_by_ordinal.yml b/rules/windows/process_creation/win_susp_rundll32_by_ordinal.yml
index 584e5f49e..64c953780 100644
--- a/rules/windows/process_creation/win_susp_rundll32_by_ordinal.yml
+++ b/rules/windows/process_creation/win_susp_rundll32_by_ordinal.yml
@@ -18,7 +18,8 @@ logsource:
     product: windows
 detection:
     selection:
-        CommandLine: '*\rundll32.exe *,#*'
+        CommandLine|contains: '\rundll32.exe'
+        CommandLine|contains: ',#'
     condition: selection
 falsepositives:
     - False positives depend on scripts and administrative tools used in the monitored environment