diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml
index 194fada226..c565d442b8 100644
--- a/detections/endpoint/disable_amsi_through_registry.yml
+++ b/detections/endpoint/disable_amsi_through_registry.yml
@@ -6,20 +6,22 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to identify modification in registry to disable AMSI windows feature to evade detections.
-  This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to 
-  be able to execute payload with minimal alert as much as possible.
+description: this search is to identify modification in registry to disable AMSI windows
+  feature to evade detections. This technique was seen in several ransomware, RAT
+  and even APT to impaire defenses of the compromise machine and to be able to execute
+  payload with minimal alert as much as possible.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows Script\\Settings\\AmsiEnable"
-  Registry.registry_value_name = "DWORD (0x00000000)" by Registry.registry_path Registry.registry_key_name
-  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `disable_amsi_through_registry_filter`'
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
+  Script\\Settings\\AmsiEnable" Registry.registry_value_name = "DWORD (0x00000000)"
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disable_amsi_through_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
   that this registry was included in your config files ex. sysmon config to be monitored.
-known_false_positives: network operator may disable this feature of windows but not so common.
+known_false_positives: network operator may disable this feature of windows but not
+  so common.
 references:
 - https://blog.f-secure.com/hunting-for-amsi-bypasses/
 - https://gist.github.com/rxwx/8955e5abf18dc258fd6b43a3a7f4dbf9
@@ -41,4 +43,7 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data2/windows-sysmon.log