diff --git a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml
index 30e4c42f3c..217c89eadb 100644
--- a/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml
+++ b/detections/web/confluence_unauthenticated_remote_code_execution_cve_2022_26314.yml
@@ -9,7 +9,7 @@ datamodel:
 description: The following analytic assists with identifying CVE-2022-26314 based exploitation utilizing the Web datamodel to cover network and CIM compliant web logs. The parameters were captured from live scanning and the POC provided by Rapid7. 
   During triage, review any endpoint based logs for further activity including writing a jsp file to disk and commands/processes spawning running as root from the Confluence process.
 search: '| tstats count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*" 
+  as lastTime from datamodel=Web where Web.url IN ("*${*", "*%2F%7B*") (Web.url="*org.apache.commons.io.IOUtils*" Web.url="*java.lang.Runtime@getRuntime().exec*") OR (Web.url="*java.lang.Runtime%40getRuntime%28%29.exec*" Web.url="*org.apache.commons.io.IOUtils%40*")
   by Web.http_user_agent Web.http_method, Web.url,Web.url_length Web.src, Web.dest sourcetype
   | `drop_dm_object_name("Web")`
   | `security_content_ctime(firstTime)`