diff --git a/rules/windows/process_creation/sysmon_apt_sourgrum.yml b/rules/windows/process_creation/sysmon_apt_sourgrum.yml
index 1a6c50cd3..5cfbb594c 100644
--- a/rules/windows/process_creation/sysmon_apt_sourgrum.yml
+++ b/rules/windows/process_creation/sysmon_apt_sourgrum.yml
@@ -9,14 +9,15 @@ references:
     - https://github.com/Azure/Azure-Sentinel/blob/master/Detections/MultipleDataSources/SOURGUM_IOC.yaml
     - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
 date: 2021/06/15
+modified: 2021/07/30
 tags:
     - attack.t1546
     - attack.t1546.015
     - attack.persistence
     - attack.privilege_escalation
 logsource:
+    product: windows
     category: process_creation
-    product: sysmon
 detection:
     selection1:
         Image|contains: 'windows\system32\Physmem.sys'