diff --git a/modules/signatures/windows/network_c2_etherhiding.py b/modules/signatures/windows/network_c2_etherhiding.py
index 0f3eafe8..5bb5f242 100644
--- a/modules/signatures/windows/network_c2_etherhiding.py
+++ b/modules/signatures/windows/network_c2_etherhiding.py
@@ -50,9 +50,8 @@ def on_call(self, call, process):
         # Dynamically grab the payload regardless of which networking API was used
         buffer_data = (
             self.get_argument(call, "buffer")
-            or self.get_argument(call, "lpBuffer")
-            or self.get_argument(call, "lpOptional")
             or self.get_argument(call, "Buffer")
+            or self.get_argument(call, "Optional")
             or self.get_argument(call, "PostData")
         )