diff --git a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
index e3fa20820f..9444d3e8d4 100644
--- a/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
+++ b/detections/endpoint/ssa___hiding_files_and_directories_with_attrib_exe.yml
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
   "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
   null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
   null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
-  cmd_line IS NOT NULL AND like(cmd_line, "%+h%") AND process_name="attrib.exe" |
+  cmd_line IS NOT NULL AND match_regex(cmd_line, /\+h/)=true AND process_name="attrib.exe" |
   eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
   "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
   "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
@@ -76,3 +76,4 @@ tags:
   - _time
   risk_score: 72
   security_domain: endpoint
+