diff --git a/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml b/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml
index 92331f683e..a3ff049444 100644
--- a/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml
+++ b/tests/endpoint/linux_possible_append_command_to_at_allow_config_file.test.yml
@@ -3,10 +3,10 @@ tests:
 - name: Linux Possible Append Command To At Allow Config File
   file: endpoint/linux_possible_append_command_to_at_allow_config_file.yml
   pass_condition: '| stats count | where count > 0'
-  earliest_time: '-24h'
+  earliest_time: '-30d'
   latest_time: 'now'
   attack_data:
   - file_name: sysmon_linux.log
     data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
-    sourcetype: sysmon_linux
\ No newline at end of file
+    sourcetype: sysmon_linux