diff --git a/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml b/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml
index fe58e5519c1..fa4cdf120ba 100644
--- a/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml
+++ b/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml
@@ -9,7 +9,8 @@ author: frack113
 date: 2022/12/11
 modified: 2022/12/20
 tags:
-    - attack.credential_access
+    - attack.privilege_escalation
+    - attack.persistence
     - attack.t1546.008
 logsource:
     product: windows