diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
index 989bc63449..631d1fcc12 100644
--- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
+++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml
@@ -30,6 +30,7 @@ tags:
   - FIN7
   - Remcos
   - AgentTesla
+  - 3CX Supply Chain Attack
   confidence: 70
   context:
   - Source:Endpoint
diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
index 02678b1579..a65d2c16ca 100644
--- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
+++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml
@@ -31,6 +31,7 @@ tags:
   - Remcos
   - Azorult
   - AgentTesla
+  - 3CX Supply Chain Attack
   confidence: 70
   context:
   - Source:Endpoint