diff --git a/host-interaction/file-system/files/list/enumerate-files-on-linux.yml b/host-interaction/file-system/files/list/enumerate-files-on-linux.yml
index 36970863..ff6c579b 100644
--- a/host-interaction/file-system/files/list/enumerate-files-on-linux.yml
+++ b/host-interaction/file-system/files/list/enumerate-files-on-linux.yml
@@ -7,6 +7,8 @@ rule:
     scope: function
     att&ck:
       - Discovery::File and Directory Discovery [T1083]
+    mbc:
+      - Discovery::File and Directory Discovery [E1083]
     examples:
       - 7351f8a40c5450557b24622417fc478d:0x405438
   features:
diff --git a/host-interaction/file-system/files/list/enumerate-files-on-windows.yml b/host-interaction/file-system/files/list/enumerate-files-on-windows.yml
index 24bc5fe2..86be0d68 100644
--- a/host-interaction/file-system/files/list/enumerate-files-on-windows.yml
+++ b/host-interaction/file-system/files/list/enumerate-files-on-windows.yml
@@ -8,6 +8,8 @@ rule:
     scope: function
     att&ck:
       - Discovery::File and Directory Discovery [T1083]
+    mbc:
+      - Discovery::File and Directory Discovery [E1083]
     references:
       - https://github.com/hfiref0x/TDL/blob/cc4b46ae1c939b14a22a734a727b163f873a41b5/Source/Furutaka/sup.c#L315
     examples:
diff --git a/host-interaction/file-system/files/list/enumerate-files-recursively.yml b/host-interaction/file-system/files/list/enumerate-files-recursively.yml
index d17d2019..198c21bf 100644
--- a/host-interaction/file-system/files/list/enumerate-files-recursively.yml
+++ b/host-interaction/file-system/files/list/enumerate-files-recursively.yml
@@ -8,6 +8,8 @@ rule:
     scope: function
     att&ck:
       - Discovery::File and Directory Discovery [T1083]
+    mbc:
+      - Discovery::File and Directory Discovery [E1083]
     examples:
       - 5f66b82558ca92e54e77f216ef4c066c:0x40640E
   features:
diff --git a/load-code/powershell/run-powershell-expression.yml b/load-code/powershell/run-powershell-expression.yml
index 8437a6af..00d86d98 100644
--- a/load-code/powershell/run-powershell-expression.yml
+++ b/load-code/powershell/run-powershell-expression.yml
@@ -7,6 +7,8 @@ rule:
     scope: function
     att&ck:
       - Execution::Command and Scripting Interpreter::PowerShell [T1059.001]
+    mbc:
+      - Execution::Command and Scripting Interpreter [E1059]
     examples:
       - 692f7fd6d198e804d6af98eb9e390d61:0x6000004
   features: