diff --git a/rules/windows/process_creation/process_creation_discover_private_keys.yml b/rules/windows/process_creation/process_creation_discover_private_keys.yml
index 99251447..7400b511 100644
--- a/rules/windows/process_creation/process_creation_discover_private_keys.yml
+++ b/rules/windows/process_creation/process_creation_discover_private_keys.yml
@@ -7,7 +7,7 @@ description: Adversaries may search for private key certificate files on comprom
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1552.004/T1552.004.md
 tags:
-    - attack.credential-access
+    - attack.credential_access
     - attack.t1552.004
 logsource:
     category: process_creation