diff --git a/rules/windows/network_connection/sysmon_susp_rdp.yml b/rules/windows/network_connection/sysmon_susp_rdp.yml
index e12fde626..9867e2b1d 100755
--- a/rules/windows/network_connection/sysmon_susp_rdp.yml
+++ b/rules/windows/network_connection/sysmon_susp_rdp.yml
@@ -38,9 +38,11 @@ detection:
             - '\FSAssessment.exe'
             - '\MobaRTE.exe'
             - '\chrome.exe'
+            - '\System32\dns.exe'
             - '\thor.exe'
             - '\thor64.exe'
     condition: selection and not filter 
 falsepositives:
     - Other Remote Desktop RDP tools
+    - domain controller using dns.exe
 level: high