diff --git a/detections/endpoint/suspicious_lnk_file_launching_a_process.yml b/detections/endpoint/suspicious_lnk_file_launching_a_process.yml
index ed91fbe27e..04249d5d30 100644
--- a/detections/endpoint/suspicious_lnk_file_launching_a_process.yml
+++ b/detections/endpoint/suspicious_lnk_file_launching_a_process.yml
@@ -12,17 +12,16 @@ type: ESCU
 author: Jose Hernandez, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.lnk"
-  AND Filesystem.file_path="C:\\Temp*"  by
-  _time span=1h Filesystem.process_id Filesystem.file_name Filesystem.file_path Filesystem.file_hash
-  Filesystem.user | `drop_dm_object_name(Filesystem)` | rename process_id as lnk_pid
-  | join lnk_pid, _time [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
-  where Processes.process_name=*  by _time span=1h Processes.parent_process_id Processes.process_id
-  Processes.process_name Processes.dest Processes.process_path Processes.process |
-  `drop_dm_object_name(Processes)` | rename parent_process_id as lnk_pid | fields
-  _time lnk_pid process_id dest process_name process_path process] | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | table firstTime, lastTime, lnk_pid, process_id,
-  user, dest, file_name, file_path, process_name, process, process_path, file_hash
-  | `suspicious_lnk_file_launching_a_process_filter` '
+  AND Filesystem.file_path="C:\\Temp*"  by _time span=1h Filesystem.process_id Filesystem.file_name
+  Filesystem.file_path Filesystem.file_hash Filesystem.user | `drop_dm_object_name(Filesystem)`
+  | rename process_id as lnk_pid | join lnk_pid, _time [| tstats `security_content_summariesonly`
+  count FROM datamodel=Endpoint.Processes where Processes.process_name=*  by _time
+  span=1h Processes.parent_process_id Processes.process_id Processes.process_name
+  Processes.dest Processes.process_path Processes.process | `drop_dm_object_name(Processes)`
+  | rename parent_process_id as lnk_pid | fields _time lnk_pid process_id dest process_name
+  process_path process] | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | table firstTime, lastTime, lnk_pid, process_id, user, dest, file_name, file_path,
+  process_name, process, process_path, file_hash | `suspicious_lnk_file_launching_a_process_filter` '
 known_false_positives: This detection should yield little or no false positive results.
   It is uncommon for LNK files to execute process from temporary or user directories.
 tags:
@@ -41,3 +40,6 @@ tags:
   - PR.DS
   security_domain: network
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/lnk_file_temp_folder/windows-sysmon.log
diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
index c95f8b1775..4a57b90630 100644
--- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
@@ -31,3 +31,6 @@ tags:
   - PR.IP
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log