diff --git a/network/detection/dropbear-cbc-ciphers.yaml b/network/detection/dropbear-cbc-ciphers.yaml
index 706f72f47c..ed808d4394 100644
--- a/network/detection/dropbear-cbc-ciphers.yaml
+++ b/network/detection/dropbear-cbc-ciphers.yaml
@@ -28,3 +28,4 @@ network:
         words:
           - "cbc"
           - "SSH-"
+        condition: and