diff --git a/Exclusion Rules/900000-exclusion_rules.xml b/Exclusion Rules/900000-exclusion_rules.xml
index 4c008cd..f885b6a 100644
--- a/Exclusion Rules/900000-exclusion_rules.xml	
+++ b/Exclusion Rules/900000-exclusion_rules.xml	
@@ -519,7 +519,7 @@
   <!-- Exclude Windows Defender DNS Queries -->
   <rule id="900074" level="1">
     <if_sid>121101</if_sid>
-    <field name="win.eventdata.image" type="pcre2">(?i)C:\\\\Program Files\\\\Windows Defender Advanced Threat Protection</field>
+    <field name="win.eventdata.image" type="pcre2">(?i)^C:\\\\Program Files\\\\Windows Defender Advanced Threat Protection</field>
     <description>Exceptions rule created for Exclude Windows Defender DNS Queries.</description>
     <options>no_full_log</options>
   </rule>