diff --git a/modules/signatures/windows/windows_utilities.py b/modules/signatures/windows/windows_utilities.py
index 3af6b428..f3fe2d20 100644
--- a/modules/signatures/windows/windows_utilities.py
+++ b/modules/signatures/windows/windows_utilities.py
@@ -163,6 +163,8 @@ def run(self):
             "csvde",
             "del ",
             "del.exe",
+            "devcon ",
+            "devcon.exe",
             "diskshadow",
             "dsquery",
             "icacls",