diff --git a/detections/endpoint/macos_plutil.yml b/detections/endpoint/macos_plutil.yml
index 3401678938..a847e5eb7d 100644
--- a/detections/endpoint/macos_plutil.yml
+++ b/detections/endpoint/macos_plutil.yml
@@ -39,7 +39,7 @@ tags:
   - Actions on Objectives
   message: plutil are executed on $host$ from $user$
   mitre_attack_id:
-  - T1547.011
+  - T1647
   nist:
   - DE.CM
   observable: