diff --git a/tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml b/tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
index e80826db41..35d3148446 100644
--- a/tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
+++ b/tests/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
@@ -5,5 +5,8 @@ tests:
     pass_condition: '@count_gt(0)'
     description: Test credential dumping detections
     attack_data:
-      - file_name: windows-security-events_ssa.log
-        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log
+      - file_name: windows-security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
+        source: WinEventLog:Security
+        sourcetype: xmlwineventlog
+        update_timestamp: True
\ No newline at end of file