diff --git a/yml/OSBinaries/MpCmdRun.yml b/yml/OSBinaries/MpCmdRun.yml
index 35cc106..630d802 100644
--- a/yml/OSBinaries/MpCmdRun.yml
+++ b/yml/OSBinaries/MpCmdRun.yml
@@ -29,10 +29,13 @@ Code_Sample:
 Detection: 
   - IOC: MpCmdRun storing data into alternate data streams.
   - IOC: MpCmdRun getting a file from a remote machine or the internet that is not expected.
+  - IOC: Monitor process creation for non-SYSTEM and non-LOCAL SERVICE accounts launching mpcmdrun.exe.
+  - IOC: Monitor for the creation of %USERPROFILE%\AppData\Local\Temp\MpCmdRun.log
 Resources:
   - Link: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus
   - Link: https://twitter.com/mohammadaskar2/status/1301263551638761477
   - Link: https://twitter.com/Oddvarmoe/status/1301444858910052352
+  - Link: https://twitter.com/NotMedic/status/1301506813242867720
 Acknowledgement:
   - Person: Askar
     Handle: '@mohammadaskar2'