diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml
index 2e439244cc..d82f0b92d0 100644
--- a/detections/endpoint/office_product_spawning_certutil.yml
+++ b/detections/endpoint/office_product_spawning_certutil.yml
@@ -36,6 +36,7 @@ tags:
   analytic_story:
   - Spearphishing Attachments
   - AgentTesla
+  - Trickbot
   confidence: 90
   context:
   - Source:Endpoint