diff --git a/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml b/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml
index 99ea741c5..a6e17482a 100644
--- a/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml
+++ b/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml
@@ -21,7 +21,7 @@ logsource:
 detection:
     selection_dsamain:
         Image|endswith: '\dnscmd.exe'
-    selection_recon1:
+    selection_1:
         CommandLine|contains:
             - '/enumrecords'
             - '/enumzones'