diff --git a/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml b/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml
index dd6e0e06f..cd608a639 100644
--- a/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml
+++ b/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml
@@ -4,7 +4,7 @@ integration = ["system", "windows"]
 maturity = "production"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
-updated_date = "2024/01/09"
+updated_date = "2024/05/14"
 
 [rule]
 author = ["Elastic"]
@@ -15,7 +15,7 @@ administrator to SYSTEM.
 """
 from = "now-9m"
 index = ["winlogbeat-*", "logs-system.*", "logs-windows.*"]
-language = "kuery"
+language = "eql"
 license = "Elastic License v2"
 name = "Windows Service Installed via an Unusual Client"
 references = [
@@ -44,14 +44,17 @@ Audit Security System Extension (Success)
 severity = "high"
 tags = ["Domain: Endpoint", "OS: Windows", "Use Case: Threat Detection", "Tactic: Privilege Escalation"]
 timestamp_override = "event.ingested"
-type = "query"
+type = "eql"
 
 query = '''
-event.action:"service-installed" and
-  (winlog.event_data.ClientProcessId:"0" or winlog.event_data.ParentProcessId:"0") and
+configuration where host.os.type == "windows" and
+  event.action == "service-installed" and
+  (winlog.event_data.ClientProcessId == "0" or winlog.event_data.ParentProcessId == "0") and
   not winlog.event_data.ServiceFileName : (
-    "C:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe" or
-    "%SystemRoot%\\system32\\Drivers\\Crowdstrike\\17706-CsInstallerService.exe"
+    "?:\\Windows\\VeeamVssSupport\\VeeamGuestHelper.exe",
+    "?:\\Windows\\VeeamLogShipper\\VeeamLogShipper.exe",
+    "%SystemRoot%\\system32\\Drivers\\Crowdstrike\\*-CsInstallerService.exe",
+    "\"%windir%\\AdminArsenal\\PDQInventory-Scanner\\service-1\\PDQInventory-Scanner-1.exe\" "
   )
 '''