diff --git a/tests/endpoint/windows_security_account_manager_stopped.test.yml b/tests/endpoint/windows_security_account_manager_stopped.test.yml
index 337da0feca..a6d94fcedb 100644
--- a/tests/endpoint/windows_security_account_manager_stopped.test.yml
+++ b/tests/endpoint/windows_security_account_manager_stopped.test.yml
@@ -1,7 +1,7 @@
 name:  Windows Security Account Manager Stopped
 detections:
 - name:  Windows Security Account Manager Stopped
-  file: detections/endpoint/windows_security_account_manager_stopped.yml
+  file: endpoint/windows_security_account_manager_stopped.yml
   pass_condition: '| stats count | where count > 0'
 - attack_data:
   file_name: windows-sysmon.log