diff --git a/10_process_access/include_possible_dll_injection.xml b/10_process_access/include_possible_dll_injection.xml
index d4ee35a6..49240eb3 100644
--- a/10_process_access/include_possible_dll_injection.xml
+++ b/10_process_access/include_possible_dll_injection.xml
@@ -4,9 +4,9 @@
       <ProcessAccess onmatch="include">
         <Rule groupRelation="and">
           <CallTrace name="technique_id=T1055.001,technique_name=Dynamic-link Library Injection" condition="contains all">C:\Windows\SYSTEM32\ntdll.dll;C:\Windows\System32\kernelbase.dll;UNKNOWN</CallTrace>          <!--@darkquassar-->
-          <GrantedAccess name="technique_id=T1055.001,technique_name=Dynamic-link Library Injection" condition="contains any">0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF;0x147A</GrantedAccess>
+          <GrantedAccess name="technique_id=T1055.001,technique_name=Dynamic-link Library Injection" condition="contains any">0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF;0x147A;0x1028</GrantedAccess>
         </Rule>
       </ProcessAccess>
     </RuleGroup>
   </EventFiltering>
-</Sysmon>
\ No newline at end of file
+</Sysmon>