diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml
index 8b221e113b..89d781fbc0 100644
--- a/detections/endpoint/winword_spawning_windows_script_host.yml
+++ b/detections/endpoint/winword_spawning_windows_script_host.yml
@@ -31,7 +31,7 @@ references:
 - https://attack.mitre.org/techniques/T1566/001/
 tags:
   analytic_story:
-  - Spearphishing Attachment
+  - Spearphishing Attachments
   confidence: 100
   context:
   - Source:Endpoint