diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml
index 7f5ad40d08..3321a6f6bb 100644
--- a/detections/cloud/aws_iam_delete_policy.yml
+++ b/detections/cloud/aws_iam_delete_policy.yml
@@ -31,7 +31,7 @@ tags:
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
   kill_chain_phases:
-  - Privilege Escalation
+  - Actions on Objectives
   mitre_attack_id:
   - T1098
   product: