diff --git a/rules/windows/process_creation/win_susp_net_execution.yml b/rules/windows/process_creation/win_susp_net_execution.yml
index ad5fcd6bc..dfa3e7307 100644
--- a/rules/windows/process_creation/win_susp_net_execution.yml
+++ b/rules/windows/process_creation/win_susp_net_execution.yml
@@ -15,7 +15,7 @@ tags:
     - attack.t1135
     - attack.lateral_movement
     - attack.discovery
-    - attack.defense.evasion
+    - attack.defense_evasion
 logsource:
     category: process_creation
     product: windows