diff --git a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
index b5c7892357..27f6cccdc7 100644
--- a/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
+++ b/detections/cloud/o365_email_send_and_hard_delete_exfiltration_behavior.yml
@@ -61,7 +61,7 @@ rba:
     score: 40
   threat_objects:
   - field: subject
-    type: signature    
+    type: email_subject    
 tags:
   analytic_story: 
   - Office 365 Account Takeover