diff --git a/detection-rules/attachment_ics_sus_prodid.yml b/detection-rules/attachment_ics_sus_prodid.yml
index 5767c658622..bc02e5394b4 100644
--- a/detection-rules/attachment_ics_sus_prodid.yml
+++ b/detection-rules/attachment_ics_sus_prodid.yml
@@ -18,6 +18,14 @@ source: |
             regex.icontains(beta.file.parse_ics(.).product_id,
                             '-//[a-z0-9]*[0-9][a-z0-9]*//EN'
             )
+            or (
+              regex.match(beta.file.parse_ics(.).product_id,
+                          '-//[A-Za-z0-9]{8}//EN'
+              )
+              and not regex.match(beta.file.parse_ics(.).product_id,
+                                  '-//[A-Z][a-z]+//EN'
+              )
+            )
             or strings.icontains(beta.file.parse_ics(.).product_id,
                                  "-//MyApp//example.com//",
                                  "-//My App//NS9 Calendar//EN",
@@ -39,7 +47,10 @@ source: |
                                  "-//X7fG3//Y2kL9//M9nP4 16.0 MIMEDIR//EN",
                                  "-//HRNotify//CompChange 1.0//EN",
                                  "-//Prof Morales Sender//EN",
-                                 "//NONSGML Event//EN"
+                                 "//NONSGML Event//EN",
+                                 "-test-mailer",
+                                 "-//Meeting Invitation//EN",
+                                 "-//Email Sender//Calendar Event//EN"
             )
           )
   )