diff --git a/detections/abnormally_high_aws_instances_launched_by_user.yml b/detections/abnormally_high_aws_instances_launched_by_user.yml
index 2e78b07fc9..5a496f8565 100644
--- a/detections/abnormally_high_aws_instances_launched_by_user.yml
+++ b/detections/abnormally_high_aws_instances_launched_by_user.yml
@@ -30,7 +30,6 @@ tags:
   - Actions on Objectives
   mitre_attack_id:
   - T1078
-  - T1496
   cis20:
   - CIS 13
   nist: