diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml
index eb067a7225..1138be6148 100644
--- a/detections/endpoint/detect_mshta_renamed.yml
+++ b/detections/endpoint/detect_mshta_renamed.yml
@@ -31,7 +31,7 @@ tags:
   cis20:
   - CIS 8
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -44,3 +44,4 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   security_domain: endpoint
+  automated_detection_testing: passed
diff --git a/tests/endpoint/detect_mshta_renamed.test.yml b/tests/endpoint/detect_mshta_renamed.test.yml
new file mode 100644
index 0000000000..6fb5022a26
--- /dev/null
+++ b/tests/endpoint/detect_mshta_renamed.test.yml
@@ -0,0 +1,12 @@
+name: Detect mshta Rename line test
+tests:
+- name: Detect mshta Rename
+  file: endpoint/detect_mshta_renamed.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file