diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
index 14b5808c57..3d841bd9c8 100644
--- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
+++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml
@@ -38,3 +38,5 @@ tags:
   security_domain: endpoint
   asset_type: Endpoint
   automated_detection_testing: passed
+  dataset:
+  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1574.011_custom_eb03d0db-448b-446f-8b46-d9bc39cc8cc7/windows-sysmon.log