diff --git a/detection-rules/credential_phishing_esign_document_notification.yml b/detection-rules/credential_phishing_esign_document_notification.yml
index f8ccec6bb7b..354a2e57ca6 100644
--- a/detection-rules/credential_phishing_esign_document_notification.yml
+++ b/detection-rules/credential_phishing_esign_document_notification.yml
@@ -29,6 +29,7 @@ source: |
                           "\\beSign",
                           "e\\.sign",
                           "esign.[0o]nline",
+                          "[SsZz][lL][GgSs][Nn].*D[0o]c",
                           "e-d[0o]c",
                           "e-signature",
                           "eSignature",