diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
index c77d32a57e..03049346b9 100644
--- a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
@@ -58,7 +58,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
   impact: 80
   kill_chain_phases:
   - Exfiltration
diff --git a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
index 57cd2b8000..b92fd512b0 100644
--- a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
+++ b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
@@ -4,6 +4,6 @@ tests:
   file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: windows-sysmon_curl_upload.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
+    source: WinEventLog:security
\ No newline at end of file