diff --git a/tests/endpoint/first_time_seen_running_windows_service.test.yml b/tests/endpoint/first_time_seen_running_windows_service.test.yml
index 15fbd395f0..70fb5203bf 100644
--- a/tests/endpoint/first_time_seen_running_windows_service.test.yml
+++ b/tests/endpoint/first_time_seen_running_windows_service.test.yml
@@ -9,8 +9,8 @@ tests:
   - name: Previously Seen Running Windows Services - Initial
     file: baselines/previously_seen_running_windows_services.yml
     pass_condition: '| stats count | where count > 0'
-    earliest_time: '-30m@m'
-    latest_time: '-7m@m'
+    earliest_time: '-24h'
+    latest_time: '-10m@m'
   attack_data:
   - file_name: windows-system.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/first_time_windows_service/windows-system.log