diff --git a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index a506cb395b..45343cacbf 100644
--- a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,6 +1,6 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
-version: 3
+version: 4
 date: '2022-03-01'
 author: Ignacio Bermudez Corrales, Splunk
 status: production
@@ -31,8 +31,9 @@ search:
     actor.process.file.name: chrome.exe
   selection5:
     process.cmd_line: chrome-extension
-  condition: selection1 or (selection2 and not selection3) or (selection4 and not
-    selection5)
+  selection6:
+    process.file.name: cmd.exe
+  condition: ((selection1) or (selection2 and not selection3) or (selection4 and not selection5)) and selection6
 how_to_implement: In order to successfully implement this analytic, you will need
   endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
diff --git a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index 1b1cde45ee..66f8616fc8 100644
--- a/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,6 +1,6 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
-version: 3
+version: 4
 description: The following analytic identifies parent processes, browsers, Windows
   terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
   many applications spawn cmd.exe natively or built into macros. Much of this will
@@ -22,13 +22,14 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
   "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
   any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
+  null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
   OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe"
   OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
   OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe"
   OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe"
   AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe"
-  AND (NOT process_cmd_line="chrome-extension")) 
+  AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe"
+  
   | eval body=create_map(
     "devices", [
         create_map(
diff --git a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index ebec5b0d61..5b8c1e4f57 100644
--- a/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/ssa_detections/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,6 +1,6 @@
 name: Detect Prohibited Applications Spawning cmd exe
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
-version: 3
+version: 4
 date: '2022-03-01'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
@@ -28,13 +28,14 @@ search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(inpu
   "string", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"),
   "string", null) | eval device=ucast(map_get(input_event,"device"), "map<string,
   any>", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string",
-  null) | where (actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
+  null) | where ((actor_process_file_name="winword.exe" OR actor_process_file_name="excel.exe"
   OR actor_process_file_name="outlook.exe" OR actor_process_file_name="acrobat.exe"
   OR actor_process_file_name="acrord32.exe" OR actor_process_file_name="iexplore.exe"
   OR actor_process_file_name="opera.exe" OR actor_process_file_name="firefox.exe"
   OR actor_process_file_name="powershell.exe") OR (actor_process_file_name="java.exe"
   AND (NOT match_regex(actor_process_file_name, /(?i)patch1-Hotfix1a/)=true)) OR (actor_process_file_name="chrome.exe"
-  AND (NOT process_cmd_line="chrome-extension")) --finding_report--'
+  AND (NOT process_cmd_line="chrome-extension"))) AND process_file_name="cmd.exe"
+  --finding_report--'
 how_to_implement: In order to successfully implement this analytic, you will need
   endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.