diff --git a/detections/delete_shadow_copies.yml b/detections/delete_shadow_copies.yml
index 49ba6e8edf..7b286d1e33 100644
--- a/detections/delete_shadow_copies.yml
+++ b/detections/delete_shadow_copies.yml
@@ -95,7 +95,9 @@ mappings:
   kill_chain_phases:
     - Actions on Objectives
   mitre_attack:
-    - Execution
+    - Impact
+  mitre_technique_id:
+    - T1490
   nist:
     - PR.PT
     - DE.CM