diff --git a/detections/endpoint/active_directory_privilege_escalation_identified.yml b/detections/endpoint/active_directory_privilege_escalation_identified.yml
index 86ffe34cf6..fb113d4ddb 100644
--- a/detections/endpoint/active_directory_privilege_escalation_identified.yml
+++ b/detections/endpoint/active_directory_privilege_escalation_identified.yml
@@ -66,10 +66,4 @@ tags:
   - Splunk Enterprise Security
   - Splunk Cloud
   security_domain: endpoint
-tests:
-- name: True Positive Test
-  attack_data:
-  - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1484/privesc/priv_esc.log
-    source: adlm
-    sourcetype: stash
+
diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml
index d65a42cd56..2c8ba21b99 100644
--- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml
+++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml
@@ -71,6 +71,6 @@ tests:
 - name: True Positive Test
   attack_data:
   - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_sysmon_service_stop.log/linux_auditd_sysmon_service_stop.log
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_sysmon_service_stop/linux_auditd_sysmon_service_stop.log
     source: auditd
     sourcetype: auditd
diff --git a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
index f678107a88..be6efc9a01 100644
--- a/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
+++ b/detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
@@ -70,6 +70,6 @@ tests:
 - name: True Positive Test
   attack_data:
   - data: 
-      https://raw.githubusercontent.com/splunk/attack_data/master/datasets/suspicious_behaviour/log4shell_exploitation/log4shell_correlation.txt
+      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/log4shell_exploitation/log4shell_correlation.log
     source: log4shell
     sourcetype: stash