diff --git a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
index 19a7cc815e..6f701e6fd5 100644
--- a/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
+++ b/detections/endpoint/windows_lateral_tool_transfer_remcom.yml
@@ -33,7 +33,7 @@ tags:
   impact: 80
   message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to move laterally.
   mitre_attack_id:
-  - T1570
+  - T1569.002
   observable:
   - name: user
     type: User