diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml
index 609186f8a0..cd07bf1979 100644
--- a/detections/endpoint/malicious_powershell_process___encoded_command.yml
+++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml
@@ -15,10 +15,10 @@ references: []
 author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = powershell.exe
-  (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*)
-  by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.dest Processes.process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `malicious_powershell_process___encoded_command_filter`'
+  (Processes.process=*-EncodedCommand* OR Processes.process=*-enc*) by Processes.user
+  Processes.process_name Processes.process Processes.parent_process_name Processes.dest
+  Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `malicious_powershell_process___encoded_command_filter`'
 known_false_positives: System administrators may use this option, but it's not common.
 tags:
   analytics_story:
@@ -38,3 +38,6 @@ tags:
   - PR.IP
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1027/windows-sysmon.log