diff --git a/persistence/authentication-process/act-as-credential-manager-dll.yml b/persistence/authentication-process/act-as-credential-manager-dll.yml
index 55a77152e..476b650ca 100644
--- a/persistence/authentication-process/act-as-credential-manager-dll.yml
+++ b/persistence/authentication-process/act-as-credential-manager-dll.yml
@@ -6,7 +6,7 @@ rule:
       - jakub.jozwiak@mandiant.com
     scope: file
     att&ck:
-      - Persistence::Modify Authentication Process [T1556]
+      - Persistence::Modify Authentication Process::Network Provider DLL [T1556.008]
     examples:
       - b283415c9df06f0e53b7d452d3e5c840c5bd7a6ce734a30bae4a869a57974a0e
   features: