diff --git a/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml b/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml
index 66597f9a7..1b6d2b1e4 100644
--- a/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml
+++ b/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml
@@ -4,11 +4,13 @@ status: experimental
 description: Identifies when DNS zone is modified or deleted.
 references:
     - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
+    - https://attack.mitre.org/techniques/T1565/001/
 author: Austin Songer @austinsonger
 date: 2021/08/08
 modified: 2022/08/23
 tags:
     - attack.impact
+    - attack.t1565.001
 logsource:
     product: azure
     service: activitylogs