diff --git a/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml b/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
index fb2f5d65e..128bb3640 100644
--- a/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
+++ b/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
@@ -10,7 +10,7 @@ tags:
     - attack.privilege_escalation
     - attack.t1076
     - car.2013-07-002
-    - attack.t1021
+    - attack.t1021.001
 author: Florian Roth
 date: 2018/03/17
 modified: 2018/12/11