diff --git a/rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml b/rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
index 2406d2fef..c00361977 100644
--- a/rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
+++ b/rules/integrations/o365/defense_evasion_microsoft_365_exchange_malware_filter_policy_deletion.toml
@@ -1,19 +1,19 @@
 [metadata]
 creation_date = "2020/11/19"
 maturity = "production"
-updated_date = "2021/07/20"
+updated_date = "2022/01/07"
 integration = "o365"
 
 [rule]
 author = ["Elastic"]
 description = """
-Identifies when a malware filter policy has been deleted in Microsoft 365. A malware filter policy is used to alert
+Identifies when a malware filter policy has been deleted or disabled in Microsoft 365. A malware filter policy is used to alert
 administrators that an internal user sent a message that contained malware. This may indicate an account or machine
 compromise that would need to be investigated. Deletion of a malware filter policy may be done to evade detection.
 """
 false_positives = [
     """
-    A malware filter policy may be deleted by a system or network administrator. Verify that the configuration change
+    A malware filter policy may be deleted or disabled by a system or network administrator. Verify that the configuration change
     was expected. Exceptions can be added to this rule to filter expected behavior.
     """,
 ]
@@ -21,12 +21,13 @@ from = "now-30m"
 index = ["filebeat-*", "logs-o365*"]
 language = "kuery"
 license = "Elastic License v2"
-name = "Microsoft 365 Exchange Malware Filter Policy Deletion"
+name = "Microsoft 365 Exchange Malware Filter Policy Deleted or Disabled"
 note = """## Config
 
 The Microsoft 365 Fleet integration, Filebeat module, or similarly structured data is required to be compatible with this rule."""
 references = [
     "https://docs.microsoft.com/en-us/powershell/module/exchange/remove-malwarefilterpolicy?view=exchange-ps",
+    "https://docs.microsoft.com/en-us/powershell/module/exchange/disable-malwarefilterrule?view=exchange-ps"
 ]
 risk_score = 47
 rule_id = "d743ff2a-203e-4a46-a3e3-40512cfe8fbb"
@@ -36,7 +37,7 @@ timestamp_override = "event.ingested"
 type = "query"
 
 query = '''
-event.dataset:o365.audit and event.provider:Exchange and event.category:web and event.action:"Remove-MalwareFilterPolicy" and event.outcome:success
+event.dataset:o365.audit and event.provider:Exchange and event.category:web and (event.action:"Remove-MalwareFilterPolicy" or event.action:"Disable-MalwareFilterRule") and event.outcome:success
 '''