diff --git a/docs/attack-techniques/AWS/aws.discovery.ec2-download-user-data.md b/docs/attack-techniques/AWS/aws.discovery.ec2-download-user-data.md
index 9b2ef19e..7319cf9f 100755
--- a/docs/attack-techniques/AWS/aws.discovery.ec2-download-user-data.md
+++ b/docs/attack-techniques/AWS/aws.discovery.ec2-download-user-data.md
@@ -48,7 +48,7 @@ Through CloudTrail's DescribeInstanceAttribute
event.
See:
-* [Associated Sigma rule](https://github.com/SigmaHQ/sigma/blob/master/rules/cloud/aws/aws_ec2_download_userdata.yml)
+* [Associated Sigma rule](https://github.com/SigmaHQ/sigma/blob/master/unsupported/cloud/aws_ec2_download_userdata.yml)
## Detonation logs new!