diff --git a/.circleci/config.yml b/.circleci/config.yml
index 979e0e2fb8..730f789e91 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -432,7 +432,12 @@ jobs:
       - run:
           name: checkout repo
           command: |
-            if [ "${CIRCLE_BRANCH}" == "" ]; then
+            if [[ ! -z "${CIRCLE_PULL_REQUEST}" &&  ! -z "${CIRCLE_PR_NUMBER}" ]]; then
+                git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
+                cd security-content
+                git fetch origin pull/${CIRCLE_PR_NUMBER}/head:${CIRCLE_BRANCH}
+                git checkout ${CIRCLE_BRANCH}
+            elif [ "${CIRCLE_BRANCH}" == "" ]; then
                 git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
             else
                 git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
@@ -454,7 +459,11 @@ jobs:
             virtualenv --python=/usr/bin/python3 --clear venv
             source venv/bin/activate
             pip install -q -r requirements.txt
-            python main.py -b ${CIRCLE_BRANCH}
+            if [[ ! -z "${CIRCLE_PULL_REQUEST}" &&  ! -z "${CIRCLE_PR_NUMBER}" ]]; then
+                python main.py -b ${CIRCLE_BRANCH} -pr ${CIRCLE_PR_NUMBER}
+            else
+                python main.py -b ${CIRCLE_BRANCH}
+            fi
 
 
 workflows:
diff --git a/automated_detection_testing/ci/detection_testing_batch/Dockerfile b/automated_detection_testing/ci/detection_testing_batch/Dockerfile
index ffe88f2650..1ed762dde5 100644
--- a/automated_detection_testing/ci/detection_testing_batch/Dockerfile
+++ b/automated_detection_testing/ci/detection_testing_batch/Dockerfile
@@ -5,6 +5,7 @@ RUN DEBIAN_FRONTEND="noninteractive" apt-get -y install tzdata
 RUN apt-get install -y python3-dev git python-dev unzip python3-pip awscli
 RUN apt-get install -y python-gitdb
 RUN apt-get install -y wget unzip
+RUN apt-get install -y git
 
 ADD . /app
 
diff --git a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py
index 9f21d3418b..a1f58721f5 100644
--- a/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py
+++ b/automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py
@@ -19,12 +19,17 @@ def main(args):
     parser = argparse.ArgumentParser(description="CI Detection Testing")
     parser.add_argument("-b", "--branch", required=True, help="security content branch")
     parser.add_argument("-u", "--uuid", required=True, help="uuid for detection test")
+    parser.add_argument("-pr", "--pr-number", required=False, help="Pull Request Number")
 
     args = parser.parse_args()
     branch = args.branch
     uuid_test = args.uuid
+    pr_number = args.pr_number
 
-    github_service = GithubService(branch)
+    if pr_number:
+        github_service = GithubService(branch, pr_number)
+    else:
+        github_service = GithubService(branch)
     test_files = github_service.get_changed_test_files()
     if len(test_files) == 0:
         print("No new detections to test.")
diff --git a/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py b/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py
index 62913aeeec..6658d8b063 100644
--- a/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py
+++ b/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py
@@ -15,9 +15,11 @@ SECURITY_CONTENT_URL = "https://github.com/splunk/security_content"
 
 class GithubService:
 
-    def __init__(self, security_content_branch):
+    def __init__(self, security_content_branch, PR_number = None):
         self.security_content_branch = security_content_branch
         self.security_content_repo_obj = self.clone_project(SECURITY_CONTENT_URL, f"security_content", f"develop")
+        if PR_number:
+            os.system('cd security_content && git fetch origin refs/pull/' + PR_number + '/head:' + security_content_branch + ' && cd ..')
         self.security_content_repo_obj.git.checkout(security_content_branch)
 
     def clone_project(self, url, project, branch):
diff --git a/automated_detection_testing/ci/python_ci_code/main.py b/automated_detection_testing/ci/python_ci_code/main.py
index 2cd876f469..800d40085e 100644
--- a/automated_detection_testing/ci/python_ci_code/main.py
+++ b/automated_detection_testing/ci/python_ci_code/main.py
@@ -10,9 +10,11 @@ def main(args):
 
     parser = argparse.ArgumentParser(description="Detection Testing Execution")
     parser.add_argument("-b", "--branch", required=True, help="security content branch")
+    parser.add_argument("-pr", "--pr-number", required=False, help="Pull Request Number")
 
     args = parser.parse_args()
     branch = args.branch
+    pr_number = args.pr_number
 
     # vars
     max_waiting_time = 7200
@@ -23,14 +25,26 @@ def main(args):
 
     # start aws batch job
     client = boto3.client("batch", region_name="eu-central-1")
-    response = client.submit_job(
-        jobName='detection_testing',
-        jobQueue='detection_testing_execution_queue',
-        jobDefinition='detection_testing_execution:2',
-        containerOverrides={
-            'command': ['-b', branch, '-u', uuid_test]
-        }
-    )
+
+    if pr_number:
+        response = client.submit_job(
+            jobName='detection_testing',
+            jobQueue='detection_testing_execution_queue',
+            jobDefinition='detection_testing_execution:2',
+            containerOverrides={
+                'command': ['-b', branch, '-u', uuid_test, '-pr', pr_number]
+            }
+        )
+    else:
+        response = client.submit_job(
+            jobName='detection_testing',
+            jobQueue='detection_testing_execution_queue',
+            jobDefinition='detection_testing_execution:2',
+            containerOverrides={
+                'command': ['-b', branch, '-u', uuid_test]
+            }
+        )
+
 
     while max_waiting_time > current_waiting_time:
 
diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index d6f1b914d4..cc40eff0b5 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -50,3 +50,5 @@ tags:
   - Processes.process
   - Processes.dest
   security_domain: endpoint
+
+  
\ No newline at end of file