diff --git a/rules/network/net_susp_dns_txt_exec_strings.yml b/rules/network/net_susp_dns_txt_exec_strings.yml
index 8080e09b9..8b768fd91 100644
--- a/rules/network/net_susp_dns_txt_exec_strings.yml
+++ b/rules/network/net_susp_dns_txt_exec_strings.yml
@@ -5,8 +5,7 @@ references:
     - https://twitter.com/stvemillertime/status/1024707932447854592
     - https://github.com/samratashok/nishang/blob/master/Backdoors/DNS_TXT_Pwnage.ps1
 tags:
-    - attack.standard_application_layer_protocol
-    - attack.T1071
+    - attack.t1071
 author: Markus Neis
 date: 2018/08/08
 logsource: