diff --git a/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml b/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml
index 33568d16f..fd5efb7da 100644
--- a/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml
+++ b/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml
@@ -1,7 +1,7 @@
 [metadata]
 creation_date = "2020/02/18"
 maturity = "production"
-updated_date = "2021/10/04"
+updated_date = "2022/02/04"
 
 [rule]
 author = ["Elastic"]
@@ -22,7 +22,7 @@ timestamp_override = "event.ingested"
 type = "eql"
 
 query = '''
-process where event.type in ("start", "process_started") and event.action == "start" 
+process where event.type in ("start", "process_started")
   and (process.name : "vssadmin.exe" or process.pe.original_file_name == "VSSADMIN.EXE") and
   process.args in ("delete", "resize") and process.args : "shadows*"
 '''