diff --git a/rules/windows/builtin/win_rdp_localhost_login.yml b/rules/windows/builtin/win_rdp_localhost_login.yml
index 165bd12f7..a2b4842d4 100644
--- a/rules/windows/builtin/win_rdp_localhost_login.yml
+++ b/rules/windows/builtin/win_rdp_localhost_login.yml
@@ -9,7 +9,7 @@ tags:
     - attack.lateral_movement
     - attack.t1076
     - car.2013-07-002
-    - attack.t1021
+    - attack.t1021.001
 status: experimental
 author: Thomas Patzke
 logsource: