diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
index 0be577e79f..c4f2447379 100644
--- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
@@ -11,7 +11,6 @@ description: The following analytic identifies parent processes, browsers, Windo
   many applications spawn cmd.exe natively or built into macros. Much of this will
   need to be tuned to further enhance the risk.
 search: '| from read_ssa_enriched_events()
-
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
   | eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
   parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -23,7 +22,7 @@ search: '| from read_ssa_enriched_events()
   OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
   OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
   OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
-  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
+  AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)patch1-Hotfix1a/)=false)))
   OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
   IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
   | eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,