diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml
index 5055866c6c..fe81470f71 100644
--- a/detections/endpoint/powershell_4104_hunting.yml
+++ b/detections/endpoint/powershell_4104_hunting.yml
@@ -77,6 +77,7 @@ tags:
     - SystemBC
     - PHP-CGI RCE Attack on Japanese Organizations
     - Water Gamayun
+    - XWorm
   asset_type: Endpoint
   mitre_attack_id:
   - T1059.001