diff --git a/rules/windows/registry_event/sysmon_win_reg_telemetry_persistence.yml b/rules/windows/registry_event/sysmon_win_reg_telemetry_persistence.yml
index 4a87d0fda..67963ff93 100644
--- a/rules/windows/registry_event/sysmon_win_reg_telemetry_persistence.yml
+++ b/rules/windows/registry_event/sysmon_win_reg_telemetry_persistence.yml
@@ -8,6 +8,7 @@ references:
 author: Lednyov Alexey, oscd.community
 tags:
     - attack.persistence
+    - attack.t1053.005
 logsource:
     category: registry_event
     product: windows