diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml
index a0a6a4610e..4bb22f1797 100644
--- a/detections/cloud/aws_password_policy_changes.yml
+++ b/detections/cloud/aws_password_policy_changes.yml
@@ -31,7 +31,7 @@ tags:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json
   impact: 90
   kill_chain_phases:
-  - Reconnaisance
+  - Reconnaissance
   message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$
   mitre_attack_id:
   - T1201