diff --git a/rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml b/rules/windows/process_creation/win_susp_shell_spawn_from_winrm.yml
similarity index 100%
rename from rules/windows/process_access/win_susp_shell_spawn_from_winrm.yml
rename to rules/windows/process_creation/win_susp_shell_spawn_from_winrm.yml