tags (#4)

Co-authored-by: peterydzynski <peter.rydzynski1@gmail.com>
VigilantSec · Feb 5, 2025 · f506521 · f506521
1 parent ab89dfb
commit f506521
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/rules/windows/execution_suspicious_powershell_imgload.toml b/rules/windows/execution_suspicious_powershell_imgload.toml
@@ -69,6 +69,8 @@ tags = [
     "Tactic: Execution",
     "Resources: Investigation Guide",
     "Data Source: Elastic Defend",
+    "vigilant.exception.list.appplication",
+    "vigilant.exception.list.tenant",
 ]
 timestamp_override = "event.ingested"
 type = "new_terms"