diff --git a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql
index e64d714f8bb1..f1487d7a2cee 100644
--- a/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql	
+++ b/csharp/ql/src/Likely Bugs/ThreadUnsafeICryptoTransform.ql	
@@ -52,6 +52,7 @@ class ICryptoTransform extends ValueOrRefType {
 }
 
 from UnsafeField field
+where field.fromSource()
 select field,
   "Static field '" + field.getName() +
     "' contains a 'System.Security.Cryptography.ICryptoTransform' that could be used in an unsafe way."