diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
index 616f0afd71..490f523376 100644
--- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
+++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
@@ -28,7 +28,7 @@ tags:
   context:
   - Source:Endpoint
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2_operational.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational.log
   impact: 30
   kill_chain_phases:
   - Actions on Objectives
diff --git a/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml b/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml
index 2983a0f5b0..3e65f56748 100644
--- a/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml
+++ b/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml
@@ -6,8 +6,8 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: capi2_operational.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2_operational.log
+  - file_name: capi2-operational.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational.log
     source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational
     sourcetype: XmlWinEventLog
     update_timestamp: true