diff --git a/rules/cloud/azure/azure_creating_number_of_resources_detection.yml b/rules/cloud/azure/azure_creating_number_of_resources_detection.yml
index 9a50bfbe2..6d6a8c778 100644
--- a/rules/cloud/azure/azure_creating_number_of_resources_detection.yml
+++ b/rules/cloud/azure/azure_creating_number_of_resources_detection.yml
@@ -8,6 +8,7 @@ author: sawwinnnaung
 date: 2020/05/07
 modified: 2021/11/27
 tags:
+    - attack.persistence
     - attack.t1098
 logsource:
     product: azure