diff --git a/detection-rules/impersonation_sam_sba_federal_registration.yml b/detection-rules/impersonation_sam_sba_federal_registration.yml
index f538f34ec22..ad602b7def7 100644
--- a/detection-rules/impersonation_sam_sba_federal_registration.yml
+++ b/detection-rules/impersonation_sam_sba_federal_registration.yml
@@ -13,10 +13,19 @@ source: |
                     '^sba[\s-]support[\s-]\w+'
     )
     or (
-      strings.icontains(body.current_thread.text, 'sam.gov')
-      and any(html.xpath(body.html, '//img/@src').nodes,
-              strings.icontains(.raw, 'sam%20renew%20entity')
-              or regex.icontains(.raw, '[./]sam[a-z]{3,}\.com')
+      strings.icontains(body.current_thread.text,
+                        'sam.gov',
+                        'system for award management'
+      )
+      and (
+        any(html.xpath(body.html, '//img/@src').nodes,
+            strings.icontains(.raw, 'sam%20renew%20entity')
+            or regex.icontains(.raw, '[./]sam[a-z]{3,}\.com')
+        )
+        or regex.icontains(subject.base,
+                           'cage\s+code\s+[a-z0-9]{5}',
+                           'sam\s(?:renew|status)'
+        )
       )
     )
   )