diff --git a/rules/proxy/proxy_ua_susp_base64.yml b/rules/proxy/proxy_ua_susp_base64.yml
index 3af1eb8fe..2ea52fe86 100644
--- a/rules/proxy/proxy_ua_susp_base64.yml
+++ b/rules/proxy/proxy_ua_susp_base64.yml
@@ -10,8 +10,9 @@ logsource:
     category: proxy
 detection:
     selection:
-        c-useragent|endswith:
+        c-useragent|endswith: 
             - '='
+            - 'TW96aWxsY'  # base64 encoded Mozilla/ as used by YamaBot
     condition: selection
 fields:
     - ClientIP