diff --git a/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml b/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml
index 8ff5f73def..555b63bb31 100644
--- a/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml
+++ b/dev_ssa/endpoint/ssa___system_process_running_from_unexpected_location.yml
@@ -108,7 +108,6 @@ search:
     - shutdown.exe
     - shrpubw.exe
     - shadow.exe
-    - sfc.exe
     - setx.exe
     - setupugc.exe
     - setupcl.exe