diff --git a/execution_suspicious_java_netcon_childproc.toml b/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml
similarity index 100%
rename from execution_suspicious_java_netcon_childproc.toml
rename to rules/cross-platform/execution_suspicious_java_netcon_childproc.toml