diff --git a/rules/windows/builtin/win_susp_sam_dump.yml b/rules/windows/builtin/win_susp_sam_dump.yml
index 19d97f8e2..d014cb46e 100644
--- a/rules/windows/builtin/win_susp_sam_dump.yml
+++ b/rules/windows/builtin/win_susp_sam_dump.yml
@@ -15,8 +15,9 @@ logsource:
 detection:
     selection:
         EventID: 16
-        Message|contains:
-            - '\AppData\Local\Temp\SAM-*.dmp'
+        Message|contains|all:
+            - '\AppData\Local\Temp\SAM-'
+            - '.dmp'
     condition: selection
 falsepositives:
     - Penetration testing