From ff3f9fe9b329b4a7cf2ef9f6cbf36775f0437e1d Mon Sep 17 00:00:00 2001
From: Aidan Bracher <adbracher@outlook.com>
Date: Sat, 18 Jul 2020 03:02:43 +0100
Subject: [PATCH] Updated tags

---
 rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml b/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
index fb2f5d65e..128bb3640 100644
--- a/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
+++ b/rules/windows/process_creation/win_susp_tscon_rdp_redirect.yml
@@ -10,7 +10,7 @@ tags:
     - attack.privilege_escalation
     - attack.t1076
     - car.2013-07-002
-    - attack.t1021
+    - attack.t1021.001
 author: Florian Roth
 date: 2018/03/17
 modified: 2018/12/11