From f4e25f9d5cb237efe61ef531e894e684c5ead6c3 Mon Sep 17 00:00:00 2001
From: tcontreras <tcontreras@splunk.com>
Date: Mon, 3 May 2021 19:40:55 +0200
Subject: [PATCH] minor

---
 detections/endpoint/account_discovery_with_net_app.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml
index 96766208fc..8849156bbf 100644
--- a/detections/endpoint/account_discovery_with_net_app.yml
+++ b/detections/endpoint/account_discovery_with_net_app.yml
@@ -32,7 +32,7 @@ tags:
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
-  - T1059
+  - T1087.002
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security