diff --git a/detection-rules/attachment_pdf_comp_review.yml b/detection-rules/attachment_pdf_comp_review.yml
index 58a8355b352..eeaabd963f1 100644
--- a/detection-rules/attachment_pdf_comp_review.yml
+++ b/detection-rules/attachment_pdf_comp_review.yml
@@ -61,7 +61,7 @@ source: |
                 any([.scan.strings.raw, .scan.ocr.raw],
                     (
                       regex.icontains(.,
-                                      '\b(?:Remuneration Overview|Updated Compensation (?:Summary|Schedule|Details)|Access Your Statements?|Staff Performance Appraisal|Compensation Adjustment|performance appraisal|Appraisal Overview|appraisal and compensation|salary increment)\b'
+                                      '\b(?:Remuneration Overview|Updated Compensation (?:Summary|Schedule|Details)|Access Your Statements?|Staff Performance Appraisal|Compensation Adjustment|performance appraisal|Appraisal Overview|appraisal and compensation|salary (?:increment|deduction))\b'
                       )
                     )
                 )