diff --git a/windows/device-security/auditing/event-5149.md b/windows/device-security/auditing/event-5149.md
index 24b3f6ab89..82a1d84b8e 100644
--- a/windows/device-security/auditing/event-5149.md
+++ b/windows/device-security/auditing/event-5149.md
@@ -15,7 +15,7 @@ author: Mir0sh
 -   Windows Server 2016
 
 
-In most circumstances, this event occurs very rarely. It is designed to be generated when an ICPM DoS attack ended.
+In most circumstances, this event occurs very rarely. It is designed to be generated when an ICMP DoS attack ended.
 
 There is no example of this event in this document.