diff --git a/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml
index e1ee69373c..ef57ab1fea 100644
--- a/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml
+++ b/tests/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml
@@ -3,10 +3,10 @@ tests:
 - name: Linux Possible Append Cronjob Entry on Existing Cronjob File
   file: endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-30d'
   latest_time: 'now'
   attack_data:
   - file_name: sysmon_linux.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/cronjobs_entry/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
-    sourcetype: sysmon_linux
\ No newline at end of file
+    sourcetype: sysmon_linux