diff --git a/detections/processes_created_by_netsh.yml b/detections/processes_created_by_netsh.yml
index bc4fffaad1..462de0e4c1 100644
--- a/detections/processes_created_by_netsh.yml
+++ b/detections/processes_created_by_netsh.yml
@@ -1,7 +1,7 @@
 name: Processes created by netsh
 id: b89919ed-fe5f-492c-b139-95dbb162041e
 version: 3
-date: '2020-03-02'
+date: '2020-07-14'
 description: This search looks for processes launching netsh.exe to execute various
   commands via the netsh command-line utility. Netsh.exe is a command-line scripting
   utility that allows you to, either locally or remotely, display or modify the network
@@ -17,13 +17,13 @@ references: []
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process="*C:\\Windows\\System32\\netsh.exe*" by Processes.user
+  where (Processes.parent_process="*C:\\Windows\\System32\\netsh.exe*" AND Processes.process_path!="C:\\Program Files\\rempl\\sedlauncher.exe") by Processes.user
   Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name
   | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `processes_created_by_netsh_filter`'
 known_false_positives: It is unusual for netsh.exe to have any child processes in
   most environments. It makes sense to investigate the child process and verify whether
-  the process spawned is legitimate.
+  the process spawned is legitimate. We explicitely exclude "C:\Program Files\rempl\sedlauncher.exe" process path since it is a legitimate process by Mircosoft. 
 tags:
   analytics_story:
   - Netsh Abuse