diff --git a/detection-rules/link_fake_storage_alert.yml b/detection-rules/link_fake_storage_alert.yml
index 0defd73a69b..8dc140ecbd1 100644
--- a/detection-rules/link_fake_storage_alert.yml
+++ b/detection-rules/link_fake_storage_alert.yml
@@ -64,6 +64,7 @@ source: |
     or strings.icontains(subject.subject, "compliance")
     or strings.icontains(subject.subject, "max storage")
     or strings.icontains(subject.subject, "storage space")
+    or strings.icontains(subject.subject, "be deleted")
   )
   // netgate links to loopnet.com - a popular commerical property listing service
   and not (