diff --git a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
index 191d9ceed8..2883bb7b68 100644
--- a/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
+++ b/detections/endpoint/linux_ingress_tool_transfer_hunting.yml
@@ -30,12 +30,12 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
-  confidence: 0
+  confidence: 10
   context:
   - Source:Endpoint
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
-  impact: 0
+  impact: 10
   kill_chain_phases:
   - Delivery
   - Installation
@@ -76,5 +76,5 @@ tags:
   - Processes.parent_process_path
   - Processes.process_path
   - Processes.parent_process_id
-  risk_score: 0
+  risk_score: 1
   security_domain: endpoint