diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml
index 7b7bf1ef0b..28a0a9ead6 100644
--- a/detections/endpoint/recon_using_wmi_class.yml
+++ b/detections/endpoint/recon_using_wmi_class.yml
@@ -37,7 +37,7 @@ tags:
   - Source:Endpoint
   - Stage:Discovery
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log
   impact: 75
   kill_chain_phases:
   - Reconnaissance
diff --git a/tests/endpoint/recon_using_wmi_class.test.yml b/tests/endpoint/recon_using_wmi_class.test.yml
index 83de3af306..4cc79e8a7a 100644
--- a/tests/endpoint/recon_using_wmi_class.test.yml
+++ b/tests/endpoint/recon_using_wmi_class.test.yml
@@ -7,6 +7,6 @@ tests:
   latest_time: now
   attack_data:
   - file_name: windows-powershell.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log
-    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: WinEventLog
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: XmlWinEventLog