diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
index 97fe4b1f16..95d092ccba 100644
--- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml
+++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml
@@ -9,32 +9,43 @@ datamodel:
 description: 'The following analytic identifies the use of Windows Curl.exe uploading
   a file to a remote destination. \
 
-  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination. \
+  `-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
+  \
 
-  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving web application, and it is, for example, how most common HTML forms on the web work. \
+  `-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
+  web application, and it is, for example, how most common HTML forms on the web work.
+  \
 
-  HTTP multipart formposts are done with `-F`, but this appears to not be compatible with the Windows version of Curl. Will update if identified adversary tradecraft. \
+  HTTP multipart formposts are done with `-F`, but this appears to not be compatible
+  with the Windows version of Curl. Will update if identified adversary tradecraft.
+  \
 
-  Adversaries may use one of the three methods based on the remote destination and what they are attempting to upload (zip vs txt).
-  During triage, review parallel processes for further behavior. In addition, identify
-  if the upload was successful in network logs. If a file was uploaded, isolate the endpoint and review.'
+  Adversaries may use one of the three methods based on the remote destination and
+  what they are attempting to upload (zip vs txt). During triage, review parallel
+  processes for further behavior. In addition, identify if the upload was successful
+  in network logs. If a file was uploaded, isolate the endpoint and review.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where `process_curl` Processes.process
-  IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *")
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
-  Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `windows_curl_upload_to_remote_destination_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives may be limited to source control applications and may be required to be filtered out. 
+  IN ("*-T *","*--upload-file *", "*-d *", "*--data *", "*-F *") by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_curl_upload_to_remote_destination_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives may be limited to source control applications
+  and may be required to be filtered out.
 references:
-  - https://everything.curl.dev/usingcurl/uploads
-  - https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
-  - https://twitter.com/d1r4c/status/1279042657508081664?s=20
+- https://everything.curl.dev/usingcurl/uploads
+- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
+- https://twitter.com/d1r4c/status/1279042657508081664?s=20
 tags:
   analytic_story:
   - Ingress Tool Transfer
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
   kill_chain_phases:
   - Exfiltration
   mitre_attack_id:
@@ -47,11 +58,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -81,4 +92,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
\ No newline at end of file
+    - Child Process
+  automated_detection_testing: passed