diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
index afb7353178..aa346dc721 100644
--- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
+++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml
@@ -38,7 +38,7 @@ tags:
   analytic_story:
   - Lateral Movement
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log
   kill_chain_phases:
   - Lateral Movement
   mitre_attack_id:
diff --git a/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml
index 8c4494d3bc..d768bfa805 100644
--- a/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml
+++ b/tests/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.test.yml
@@ -6,7 +6,11 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: UPDATE_FILE_NAME
-    data: UPDATE_DATASET_URL
-    source: UPDATE_SPLUNK_SOURCE
-    sourcetype: UPDATE_SPLUNK_SOURCETYPE
\ No newline at end of file
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_lolbas/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+
+
+
+    
\ No newline at end of file