diff --git a/detection-rules/headers_kagoya.yml b/detection-rules/headers_kagoya.yml
new file mode 100644
index 00000000000..a30f3b5a2f5
--- /dev/null
+++ b/detection-rules/headers_kagoya.yml
@@ -0,0 +1,17 @@
+name: "Headers: Kagoya domain in routing"
+description: "Message contains kagoya.net domain in the email headers, indicating routing through Kagoya Internet Routing services."
+type: "rule"
+severity: "medium"
+source: |
+  type.inbound
+  and any(headers.domains, .root_domain == "kagoya.net")
+tags:
+ - "Attack surface reduction"
+attack_types:
+  - "Credential Phishing"
+  - "Malware/Ransomware"
+tactics_and_techniques:
+  - "Evasion"
+detection_methods:
+  - "Header analysis"
+id: "757dc3e1-7264-5509-9af1-7d44dd2e00d8"