diff --git a/rules/windows/builtin/security/win_security_successful_external_remote_rdp_login.yml b/rules/windows/builtin/security/win_security_successful_external_remote_rdp_login.yml
index 3795b622d..edb5a2c95 100644
--- a/rules/windows/builtin/security/win_security_successful_external_remote_rdp_login.yml
+++ b/rules/windows/builtin/security/win_security_successful_external_remote_rdp_login.yml
@@ -35,7 +35,7 @@ detection:
         - IpAddress|startswith:
             - 'fe80:'  # link-local address
             - 'fc'  # private address range fc00::/7
-            - 'fd'  # private address range fd00::/8
+            - 'fd'  # private address range fc00::/7
     filter_empty:
         IpAddress: '-'
     condition: selection and not 1 of filter_*
diff --git a/rules/windows/builtin/security/win_security_successful_external_remote_smb_login.yml b/rules/windows/builtin/security/win_security_successful_external_remote_smb_login.yml
index 599e5d410..4f1324f66 100644
--- a/rules/windows/builtin/security/win_security_successful_external_remote_smb_login.yml
+++ b/rules/windows/builtin/security/win_security_successful_external_remote_smb_login.yml
@@ -35,7 +35,7 @@ detection:
         - IpAddress|startswith:
             - 'fe80:'  # link-local address
             - 'fc'  # private address range fc00::/7
-            - 'fd'  # private address range fd00::/8
+            - 'fd'  # private address range fc00::/7
     filter_empty:
         IpAddress: '-'
     condition: selection and not 1 of filter_*