diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml
index b309522ed6..4bc28a6cbc 100644
--- a/detections/endpoint/deleting_shadow_copies.yml
+++ b/detections/endpoint/deleting_shadow_copies.yml
@@ -15,9 +15,10 @@ author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=vssadmin.exe
-  OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow* by Processes.user Processes.process_name Processes.parent_process_name
-  Processes.dest  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
-  `security_content_ctime(lastTime)` | `deleting_shadow_copies_filter`'
+  OR Processes.process_name=wmic.exe) Processes.process=*delete* Processes.process=*shadow*
+  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
+  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `deleting_shadow_copies_filter`'
 known_false_positives: vssadmin.exe and wmic.exe are standard applications shipped
   with modern versions of windows. They may be used by administrators to legitimately
   delete old backup copies, although this is typically rare.
@@ -39,3 +40,6 @@ tags:
   - PR.IP
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1490/windows-sysmon.log