diff --git a/investigations/rundll32_lockworkstation.yml b/detections/endpoint/rundll32_lockworkstation.yml
similarity index 97%
rename from investigations/rundll32_lockworkstation.yml
rename to detections/endpoint/rundll32_lockworkstation.yml
index f20d95d919..3a596146e7 100644
--- a/investigations/rundll32_lockworkstation.yml
+++ b/detections/endpoint/rundll32_lockworkstation.yml
@@ -1,9 +1,9 @@
 name: Rundll32 LockWorkStation
 id: fa90f372-f91d-11eb-816c-acde48001122
-version: 1
+version: 2
 date: '2021-08-09'
 author: Teoderick Contreras, Splunk
-type: Investigation
+type: Anomaly
 datamodel:
 - Endpoint
 description: This search is to detect a suspicious rundll32 commandline to lock the
@@ -46,7 +46,7 @@ tags:
     role:
     - Victim
   - name: SourceImage
-    type: process name
+    type: Process Name
     role:
     - Attacker
   product:
@@ -65,3 +65,4 @@ tags:
   - Processes.parent_process_id
   risk_score: 25
   security_domain: endpoint
+  asset_type: Endpoint
\ No newline at end of file
diff --git a/tests/endpoint/rundll32_lockworkstation.test.yml b/tests/endpoint/rundll32_lockworkstation.test.yml
new file mode 100644
index 0000000000..2e913208f4
--- /dev/null
+++ b/tests/endpoint/rundll32_lockworkstation.test.yml
@@ -0,0 +1,12 @@
+name: Rundll32 LockWorkStation Unit Test
+tests:
+- name: Rundll32 LockWorkStation
+  file: endpoint/rundll32_lockworkstation.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/conti/conti_leak/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog