diff --git a/detection-rules/recipients_undisclosed_free_subdomain_host.yml b/detection-rules/recipients_undisclosed_free_subdomain_host.yml
index 0554bc90112..b66cf12cb3c 100644
--- a/detection-rules/recipients_undisclosed_free_subdomain_host.yml
+++ b/detection-rules/recipients_undisclosed_free_subdomain_host.yml
@@ -31,6 +31,8 @@ source: |
       and sender.email.domain.domain not in $sender_domains
     )
   )
+tags:
+  - "Attack surface reduction"
 tactics_and_techniques:
   - "Free subdomain host"
 detection_methods: