diff --git a/communication/http/client/check-http-status-code.yml b/communication/http/client/check-http-status-code.yml
index 4dea7272..c1d74ab2 100644
--- a/communication/http/client/check-http-status-code.yml
+++ b/communication/http/client/check-http-status-code.yml
@@ -9,6 +9,7 @@ rule:
       - Communication::HTTP Communication::Read Header [C0002.014]
     examples:
       - 54ac78733552a62d1d05ea4ba3fc604bb49fe000d7fc948da45335b726e64d75:0x10001a20
+      - Practical Malware Analysis Lab 03-02.dll_:0x10004452
   features:
     - and:
       - os: windows
diff --git a/nursery/get-http-request-uri.yml b/nursery/get-http-request-uri.yml
new file mode 100644
index 00000000..1be9fc1f
--- /dev/null
+++ b/nursery/get-http-request-uri.yml
@@ -0,0 +1,13 @@
+rule:
+  meta:
+    name: get HTTP request URI
+    namespace: communication/http
+    authors:
+      - william.ballenthin@mandiant.com
+    scope: basic block
+    mbc:
+      - Communication::HTTP Communication [C0002]
+  features:
+    - and:
+      - api: wininet.HttpQueryInfo
+      - number: 0xD = HTTP_QUERY_URI