diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml
index e680ae157a..9a3307a7be 100644
--- a/detections/endpoint/windows_mshta_execution_in_registry.yml
+++ b/detections/endpoint/windows_mshta_execution_in_registry.yml
@@ -41,7 +41,7 @@ tags:
   - Source:Endpoint
   - Stage:Persistence
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon2.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/t1218.005/mshta_in_registry/sysmon3.log
   impact: 80
   kill_chain_phases:
   - Exploitation