diff --git a/rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml b/rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml
index 0c5df3289..e6e47c5e1 100644
--- a/rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml
+++ b/rules/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml
@@ -16,7 +16,7 @@ logsource:
     product: windows
 detection:
     selection:
-        PranetImage|endswith: '\dllhost.exe'
+        ParentImage|endswith: '\dllhost.exe'
         ParentCommandLine|contains:
             - '/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
             - '/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}'