diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
index 7c0d4a8bef..6b53a267c5 100644
--- a/detections/endpoint/disabling_systemrestore_in_registry.yml
+++ b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -51,8 +51,7 @@ tags:
   message: The Windows registry was modified to disable system restore on $dest$ by
     $user$.
   mitre_attack_id:
-  - T1562.001
-  - T1562
+  - T1490
   observable:
   - name: user
     type: User