diff --git a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
index aa454723f5..5fc9cfcd9e 100644
--- a/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
+++ b/tests/endpoint/winevent_windows_task_scheduler_event_action_started.test.yml
@@ -3,7 +3,7 @@ tests:
 - name: WinEvent Windows Task Scheduler Event Action Started
   file: endpoint/winevent_windows_task_scheduler_event_action_started.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-10d'
+  earliest_time: '-45d'
   latest_time: 'now'
   attack_data:
   - file_name: windows-taskschedule.log