diff --git a/sigma/cli/analyze.py b/sigma/cli/analyze.py
index cb3f423..adbe724 100644
--- a/sigma/cli/analyze.py
+++ b/sigma/cli/analyze.py
@@ -153,7 +153,7 @@ def analyze_attack(
                 max_color,
             ],
             "minValue": min_score,
-            "maxValue": max_score or max(scores.values()),
+            "maxValue": max_score if max_score is not None else (max(scores.values()) if scores else 0),
         },
         "techniques": layer_techniques,
     }
diff --git a/tests/files/noattack/plain_rule.yml b/tests/files/noattack/plain_rule.yml
new file mode 100644
index 0000000..3b4f099
--- /dev/null
+++ b/tests/files/noattack/plain_rule.yml
@@ -0,0 +1,9 @@
+title: Plain rule without ATT&CK tags
+id: 11111111-2222-3333-4444-555555555555
+status: test
+logsource:
+  category: process_creation
+detection:
+  selection:
+    Image|endswith: '\evil.exe'
+  condition: selection
diff --git a/tests/test_analyze.py b/tests/test_analyze.py
index 65106db..750df82 100644
--- a/tests/test_analyze.py
+++ b/tests/test_analyze.py
@@ -87,6 +87,25 @@ def test_attack_generate_min_color():
     assert "#123456" in result.stdout
 
 
+def test_attack_generate_no_attack_tags():
+    cli = CliRunner()
+    result = cli.invoke(
+        analyze_attack, ["max", "-", "tests/files/noattack"]
+    )
+    assert result.exit_code == 0
+    assert '"maxValue": 0' in result.stdout
+    assert '"techniques": []' in result.stdout
+
+
+def test_attack_generate_max_score_zero():
+    cli = CliRunner()
+    result = cli.invoke(
+        analyze_attack, ["--max-score", "0", "max", "-", "tests/files/valid"]
+    )
+    assert result.exit_code == 0
+    assert '"maxValue": 0' in result.stdout
+
+
 def test_attack_generate_no_subtechniques():
     cli = CliRunner()
     result = cli.invoke(