diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml
index 8c99a1aa20..dcd20febdc 100644
--- a/detections/endpoint/clop_ransomware_known_service_name.yml
+++ b/detections/endpoint/clop_ransomware_known_service_name.yml
@@ -6,16 +6,17 @@ author: Teoderick Contreras
 type: batch
 datamodel:
 - Endpoint
-description: This detection is to identify the common service name created by the CLOP ransomware as part of its persistence
-  and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API in creating this service entry.
-search: '`wineventlog_system` EventCode=7045 Service_Name IN ("SecurityCenterIBM", "WinCheckDRVs")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `clop_ransomware_known_service_name_filter`'
+description: This detection is to identify the common service name created by the
+  CLOP ransomware as part of its persistence and high privilege code execution in
+  the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API
+  in creating this service entry.
+search: '`wineventlog_system` EventCode=7045 Service_Name IN ("SecurityCenterIBM",
+  "WinCheckDRVs") | stats count min(_time) as firstTime max(_time) as lastTime by
+  EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `clop_ransomware_known_service_name_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the Service name, Service File Name Service Start type, and Service Type from your
-  endpoints. 
+  logs with the Service name, Service File Name Service Start type, and Service Type
+  from your endpoints.
 known_false_positives: unknown
 references:
 - https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
@@ -40,4 +41,6 @@ tags:
   - OriginalFileName
   - process_path
   security_domain: endpoint
-  
\ No newline at end of file
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/clop/clop_a/windows-system.log