diff --git a/rules/proxy/proxy_ua_suspicious.yml b/rules/proxy/proxy_ua_suspicious.yml
index 19e5ea4ab..1caec5485 100644
--- a/rules/proxy/proxy_ua_suspicious.yml
+++ b/rules/proxy/proxy_ua_suspicious.yml
@@ -24,6 +24,7 @@ detection:
         - 'CertUtil URL Agent'  # https://twitter.com/stvemillertime/status/985150675527974912
         - 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)'  # CobaltStrike Beacon https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/
         - 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0'  # used by APT28 malware https://threatvector.cylance.com/en_us/home/inside-the-apt28-dll-backdoor-blitz.html
+        - 'HTTPS'  # https://twitter.com/stvemillertime/status/1204437531632250880 
     falsepositives:
         c-useragent:
             - 'Mozilla/3.0 * Acrobat *'  # Acrobat with linked content