diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
index e619bd2d73..44f29b9c6c 100644
--- a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -1,7 +1,7 @@
 name: Windows LOLBin Binary in Non Standard Path
 id: 25689101-012a-324a-94d3-08301e6c065a
-version: 1
-date: '2022-03-18'
+version: 2
+date: '2022-06-22'
 author: Michael Haag, Splunk
 type: Anomaly
 datamodel:
@@ -29,7 +29,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND 
   match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
   AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false
-  AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp,
+  AND match_regex(process_path, /(?i)\\microsoft.net/)=false AND match_regex(process_path, /(?i)\\microsoft\\windows defender\\platform/)=false | eval start_time=timestamp,
   end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
   event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.