diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml
index 1d80a2617c..9cde991f53 100644
--- a/detections/endpoint/office_product_spawn_cmd_process.yml
+++ b/detections/endpoint/office_product_spawn_cmd_process.yml
@@ -28,11 +28,13 @@ known_false_positives: IT or network admin may create an document automation tha
 references:
 - https://twitter.com/cyb3rops/status/1416050325870587910?s=21
 - https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/
+- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing
 tags:
   analytic_story:
   - Trickbot
   - DarkCrystal RAT
   - Azorult
+  - Remcos
   confidence: 80
   context:
   - Source:Endpoint