diff --git a/rules/network/net_dns_c2_detection.yml b/rules/network/net_dns_c2_detection.yml
index bed84c6db..90a889dc2 100644
--- a/rules/network/net_dns_c2_detection.yml
+++ b/rules/network/net_dns_c2_detection.yml
@@ -1,6 +1,6 @@
-title: DNS C2 Detection
+title: Possible DNS Tunneling
 status: experimental
-description: Normally, there exists a limited amount of different dns queries for a single domain. If a huge number of dns queries were performed for a single domain, this can be an indicator that DNS is used for transferring data. 
+description: Normally, DNS logs contain a limited amount of different dns queries for a single domain. This rule detects a high amount of queries for a single domain, which can be an indicator that DNS is used to transfer data. 
 references:
     - https://zeltser.com/c2-dns-tunneling/
     - https://patrick-bareiss.com/detect-c2-traffic-over-dns-using-sigma/