diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
index 0bc478eb95..968255de4f 100644
--- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml
+++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml
@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events()
        dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
        process_name=ucast(map_get(input_event, "process_name"), "string", null),
        cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
-       cmd_line_norm=replace(cmd_line, /\w:\\[^\s]+/, "PATH"),
+       cmd_line_norm=replace(cmd_line, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
        cmd_line_norm=replace(cmd_line_norm, /\d+/, "N")
 | where process_name="cmd.exe" AND
         match_regex(ucast(cmd_line, "string", ""), /.* \/[cC] .*/)=true
diff --git a/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml b/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml
index 4df1563bb6..08b4193fe6 100644
--- a/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml
+++ b/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml
@@ -2,7 +2,7 @@ name: First time seen command line argument - SSA Unit Test
 tests:
   - name: First time seen command line argument
     file: endpoint/ssa___first_time_seen_cmd_line.yml
-    pass_condition: '@count_eq(3)'
+    pass_condition: '@count_eq(4)'
     description: Test detection of first time seen command
     attack_data:
       - file_name: first_time_seen_commandline.json