VigilantSec
diff --git a/‎rules/windows/execution_suspicious_powershell_imgload.toml‎
Lines changed: 2 additions & 0 deletions b/‎rules/windows/execution_suspicious_powershell_imgload.toml‎
Lines changed: 2 additions & 0 deletions
@@ -69,6 +69,8 @@ tags = [
  "Tactic: Execution",
  "Resources: Investigation Guide",
  "Data Source: Elastic Defend",
+ "vigilant.exception.list.appplication",
+ "vigilant.exception.list.tenant",
 ]
 timestamp_override = "event.ingested"
 type = "new_terms"
Original file line number	Diff line number	Diff line change
`@@ -69,6 +69,8 @@ tags = [`
`69`	`69`	`"Tactic: Execution",`
`70`	`70`	`"Resources: Investigation Guide",`
`71`	`71`	`"Data Source: Elastic Defend",`
	`72`	`+ "vigilant.exception.list.appplication",`
	`73`	`+ "vigilant.exception.list.tenant",`
`72`	`74`	`]`
`73`	`75`	`timestamp_override = "event.ingested"`
`74`	`76`	`type = "new_terms"`