diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml
index cf817b2e59..b76f07bf38 100644
--- a/detections/endpoint/office_document_spawned_child_process_to_download.yml
+++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml
@@ -6,18 +6,21 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to detect potential malicious office document executing lolbin child process to download payload or other malware.
-  Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track.
-search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe", "wordpad.exe") 
-  process_name = "*.exe" cmdline IN ("*http:*","*https:*")  NOT(OriginalFileName IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe"))
-  | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `office_document_spawned_child_process_to_download_filter`'
+description: this search is to detect potential malicious office document executing
+  lolbin child process to download payload or other malware. Since most of the attacker
+  abused the capability of office document to execute living on land application to
+  blend it to the normal noise in the infected machine to cover its track.
+search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
+  "excel.exe", "visio.exe", "wordpad.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*")  NOT(OriginalFileName
+  IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
+  min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
+  parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. Tune and filter known instances office application and browser may be used.
+  Sysmon TA. Tune and filter known instances office application and browser may be
+  used.
 known_false_positives: default browser not in the filter list
 references:
 - https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
@@ -43,4 +46,7 @@ tags:
   - ProcessGuid
   - Computer
   - EventCode
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log