diff --git a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml
index 54486e04e6..eaaf7d469a 100644
--- a/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml
+++ b/detections/cloud/aws_defense_evasion_putbucketlifecycle.yml
@@ -23,6 +23,8 @@ tags:
   mitre_attack_id:
   - T1562.008
   - T1562
+  - T1485.001
+  - T1485
   observable:
   - name: src
     type: IP Address