diff --git a/rules/network/zeek/zeek_http_executable_download_from_webdav.yml b/rules/network/zeek/zeek_http_executable_download_from_webdav.yml
index 5890bc8a8..47cfdcbf2 100644
--- a/rules/network/zeek/zeek_http_executable_download_from_webdav.yml
+++ b/rules/network/zeek/zeek_http_executable_download_from_webdav.yml
@@ -7,7 +7,7 @@ references:
     - https://github.com/OTRF/detection-hackathon-apt29
 tags:
     - attack.command_and_control
-    - attack.T1043
+    - attack.t1043
 logsource:
   product: zeek
   service: http