diff --git a/detection_rules/exception.py b/detection_rules/exception.py
index 37f7f2108..cad310032 100644
--- a/detection_rules/exception.py
+++ b/detection_rules/exception.py
@@ -5,7 +5,7 @@
 """Rule exceptions data."""
 
 from collections import defaultdict
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any, get_args
@@ -72,7 +72,7 @@ class ExceptionItemEntry(BaseExceptionItemEntry, MarshmallowDataclassMixin):
         type: definitions.EsDataTypes
 
     operator: definitions.ExceptionEntryOperator
-    list_vals: ListObject | None = None
+    list_vals: ListObject | None = field(default=None, metadata={"data_key": "list"})
     value: str | None | list[str] = None
 
     @validates_schema
diff --git a/pyproject.toml b/pyproject.toml
index c78cbb937..a0afea005 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "detection_rules"
-version = "1.6.26"
+version = "1.6.27"
 description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine."
 readme = "README.md"
 requires-python = ">=3.12"