diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml
index 144544ae94..dab28eac10 100644
--- a/detections/endpoint/print_processor_registry_autostart.yml
+++ b/detections/endpoint/print_processor_registry_autostart.yml
@@ -32,7 +32,7 @@ tags:
   - Windows Persistence Techniques
   - Windows Privilege Escalation
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml
index 35d0f7985e..c32f529f1b 100644
--- a/tests/endpoint/print_processor_registry_autostart.test.yml
+++ b/tests/endpoint/print_processor_registry_autostart.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-365d'
   latest_time: 'now'
   attack_data:
-  - file_name: sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log
+  - file_name: sysmon_print.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log
     source: WinEventLog:Microsoft-Windows-PrintService/Operational
     sourcetype: WinEventLog
\ No newline at end of file