diff --git a/detection-rules/link_credential_cloud_service.yml b/detection-rules/link_credential_cloud_service.yml
index 443cf68e78d..414b2410f2e 100644
--- a/detection-rules/link_credential_cloud_service.yml
+++ b/detection-rules/link_credential_cloud_service.yml
@@ -21,6 +21,13 @@ source: |
            regex.icontains(.raw, '^cloud (?:logo|storage)')
     )
     or regex.icontains(body.current_thread.text, 'cloud id:\s*#\d+')
+    // body with cloud storage usage "percentage %"
+    or (
+      regex.icontains(body.current_thread.text,
+                      '\bi?cloud\s(?:capacity|storage)\b'
+      )
+      and regex.icontains(body.current_thread.text, '\(?[0-9]{3}%\)?\s+?\b')
+    )
   )
   and any(ml.nlu_classifier(body.current_thread.text).intents,
           .name == 'cred_theft' and .confidence == 'high'