From 87a46e76cbc6d6623fa8c7ee03e8fc7c1c8e496b Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Wed, 21 Jul 2021 12:22:24 +0200
Subject: [PATCH] Update wsreset_uac_bypass.yml

---
 detections/endpoint/wsreset_uac_bypass.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml
index e2ae759d0c..e8af32da9d 100644
--- a/detections/endpoint/wsreset_uac_bypass.yml
+++ b/detections/endpoint/wsreset_uac_bypass.yml
@@ -58,4 +58,5 @@ tags:
     type: Hostname
     role:
     - Victim
-  
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/uac_bypass/windows-sysmon.log