diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
index f88b4a2fb7..521ff7a8eb 100644
--- a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
+++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
@@ -49,7 +49,7 @@ tags:
   - Source:Endpoint
   - Stage:Exfiltration
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
   impact: 50
   kill_chain_phases:
   - Exfiltration
diff --git a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
index 26bdade65a..407a7d7975 100644
--- a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
+++ b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
@@ -4,6 +4,6 @@ tests:
   file: endpoint/ssa___detect_rclone_command_line_usage.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file