diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
index 190313322e..d15f02ffd2 100644
--- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml
@@ -38,7 +38,7 @@ tags:
   analytic_story:
   - Lateral Movement
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log
   kill_chain_phases:
   - Lateral Movement
   mitre_attack_id:
diff --git a/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml
index d8493fca80..cf683a1dcb 100644
--- a/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml
+++ b/tests/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.test.yml
@@ -6,7 +6,11 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement_lolbas/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+
+    
\ No newline at end of file