diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
index deb0c58af0..ca13c9e39c 100644
--- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml
+++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
@@ -224,7 +224,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
 
   | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
-  union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" OR process_path
+  union $cond_6 | where process_path NOT LIKE "%\\windows\\system32%" AND process_path
   NOT LIKE "%\\windows\\syswow64%" | eval start_time=timestamp, end_time=timestamp,
   entities=mvappend(device, user), body=create_map(["process_path", process_path,
   "process_name", process_name]) | into write_ssa_detected_events();'