diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index 96766208fc..8849156bbf 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -32,7 +32,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
-  - T1059
+  - T1087.002
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security