diff --git a/rules/windows/process_creation/win_using_sc_to_change_sevice_image_path_by_non_admin.yml b/rules/windows/process_creation/win_using_sc_to_change_sevice_image_path_by_non_admin.yml
index 645b0034a..8f456adc6 100644
--- a/rules/windows/process_creation/win_using_sc_to_change_sevice_image_path_by_non_admin.yml
+++ b/rules/windows/process_creation/win_using_sc_to_change_sevice_image_path_by_non_admin.yml
@@ -6,7 +6,7 @@ references:
     - https://pentestlab.blog/2017/03/30/weak-service-permissions/
 tags:
     - attack.persistence
-    - attack.defence_evasion
+    - attack.defense_evasion
     - attack.privilege_escalation
     - attack.t1574.011
 status: experimental