diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml
index a615f7d163..5a15de9e89 100644
--- a/detections/endpoint/any_powershell_downloadstring.yml
+++ b/detections/endpoint/any_powershell_downloadstring.yml
@@ -36,6 +36,7 @@ tags:
   - Hermetic Wiper
   - Malicious PowerShell
   - HAFNIUM Group
+  - Data Destruction
   asset_type: Endpoint
   confidence: 70
   impact: 80