diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index f17fcdf50b..980c97ef0a 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -37,6 +37,7 @@ tags:
   - Unusual Processes
   - Ransomware
   - Masquerading - Rename System Utilities
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8