diff --git a/detections/endpoint/dcsync_attack.yml b/detections/endpoint/dcsync_attack.yml
index 78e328dac5..79c422f953 100644
--- a/detections/endpoint/dcsync_attack.yml
+++ b/detections/endpoint/dcsync_attack.yml
@@ -40,6 +40,7 @@ references:
 tags:
   analytic_story:
   - Domain Controller Attacks
+  - Credential Dumping
   asset_type: Endpoint
   cis20:
   - CIS 3
@@ -60,7 +61,7 @@ tags:
   nist:
   - DE.CM
   observable:
-   - name: src_user
+  - name: src_user
     type: User
     role:
     - Victim