diff --git a/rules/windows/process_creation/win_susp_pester.yml b/rules/windows/process_creation/win_susp_pester.yml
index 8d3f41734..41c888d69 100644
--- a/rules/windows/process_creation/win_susp_pester.yml
+++ b/rules/windows/process_creation/win_susp_pester.yml
@@ -7,10 +7,11 @@ references:
 author: Julia Fomina, oscd.community
 date: 2020/10/08
 tags:
-    - attack.defense_evasion
-    - attack.t1216
     - attack.execution
     - attack.t1059.001
+    - attack.t1086      # an old one
+    - attack.defense_evasion
+    - attack.t1216    
 logsource:
     category: process_creation
     product: windows