From a5dd917057b36fe50641e10ef0c889d581b2d044 Mon Sep 17 00:00:00 2001
From: tccontre <26181693+tccontre@users.noreply.github.com>
Date: Thu, 22 Jun 2023 11:27:01 +0200
Subject: [PATCH] Update windows_powershell_remotesigned_file.yml

---
 detections/endpoint/windows_powershell_remotesigned_file.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml
index 8aa54d0d35..aa3780ff2d 100644
--- a/detections/endpoint/windows_powershell_remotesigned_file.yml
+++ b/detections/endpoint/windows_powershell_remotesigned_file.yml
@@ -56,6 +56,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/windows-powershell-xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_remotesigned/windows-powershell-remote-xml.log
     source: XmlWinEventLog
     sourcetype: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational