diff --git a/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml b/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
index 63163d2c4..33ef79677 100644
--- a/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
+++ b/rules/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml
@@ -7,7 +7,7 @@ references:
     - https://isc.sans.edu/forums/diary/Investigating+Microsoft+BITS+Activity/23281/
 author: Florian Roth (Nextron Systems), Tim Shelton
 date: 2019/03/07
-modified: 2022/08/16
+modified: 2023/05/17
 tags:
     - attack.command_and_control
     - attack.t1071.001
@@ -21,7 +21,7 @@ detection:
     selection:
         c-useragent|startswith: 'Microsoft BITS/'
     falsepositives:
-        r-dns|endswith:
+        cs-host|endswith:
             - '.com'
             - '.net'
             - '.org'