diff --git a/detections/endpoint/windows_powershell_import_applocker_policy.yml b/detections/endpoint/windows_powershell_import_applocker_policy.yml
index 1b6154261e..842f271b2f 100644
--- a/detections/endpoint/windows_powershell_import_applocker_policy.yml
+++ b/detections/endpoint/windows_powershell_import_applocker_policy.yml
@@ -41,6 +41,9 @@ tags:
     with EventCode $EventCode$ in host $Computer$
   mitre_attack_id:
   - T1059.001
+  - T1059
+  - T1562.001
+  - T1562
   nist:
   - DE.CM
   observable: