diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
deleted file mode 100644
index 29c16b458d..0000000000
--- a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect AutoSUID post exploitation tool Unit Test
-tests:
-- name: Detect AutoSUID post exploitation tool
-  file: endpoint/detect_autosuid_post_exploitation_tool.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: autoSUID.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml
deleted file mode 100644
index 85d7de99da..0000000000
--- a/tests/endpoint/detect_linenum_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect LinEnum execution unit Test
-tests:
-- name: Detect LinEnum execution
-  file: endpoint/detect_linenum_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: LinuxEnumd.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml
deleted file mode 100644
index 1e7397a056..0000000000
--- a/tests/endpoint/detect_linpeas_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect LinPeas Execution Unit Test
-tests:
-- name: Detect LinPeas Execution
-  file: endpoint/detect_linpeas_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: linpeasdataset.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
deleted file mode 100644
index 1efcd32d23..0000000000
--- a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect Linux Exploit Suggester Execution Unit Test
-tests:
-- name: Detect Linux Exploit Suggester Execution
-  file: endpoint/detect_linux_exploit_suggester_execution.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: linuxexploitsuggesterdatasets.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"
diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml
deleted file mode 100644
index a2fff212b5..0000000000
--- a/tests/endpoint/detect_mimipenguin.test.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-name: Detect MimiPenguin Unit Test
-tests:
-- name: Detect MimiPenguin
-  file: endpoint/detect_mimipenguin.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
-  latest_time: 'now'
-  attack_data:
-  - file_name: mimipenguin.txt
-    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
-    source: "Syslog:Linux-Sysmon/Operational"
-    sourcetype: "sysmon_linux"