diff --git a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
index d8cff58983..73df4e02a1 100644
--- a/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
+++ b/detections/endpoint/windows_modify_registry_qakbot_binary_data_registry.yml
@@ -6,7 +6,7 @@ author: Teoderick Contreras, Bhavin Patel, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies a suspicious registry entry created by Qakbot malware as part of malicious execution. 
+description: The following analytic identifies a suspicious registry entry created by Qakbot malware as part of its malicious execution. 
   This "Binary Data" Registry  was created by newly spawn explorer.exe where its malicious code is injected to it. The registry consist of 8 random registry value name 
   with encrypted binary data on its registry value data. This anomaly detections can be a good pivot for possible Qakbot malware infection or other malware that uses registry 
   to save or store there config or malicious code on the registry data stream. 
diff --git a/detections/endpoint/windows_wmi_impersonate_token.yml b/detections/endpoint/windows_wmi_impersonate_token.yml
index 2a2e91e985..19a649a898 100644
--- a/detections/endpoint/windows_wmi_impersonate_token.yml
+++ b/detections/endpoint/windows_wmi_impersonate_token.yml
@@ -38,7 +38,7 @@ tags:
   - Source:Endpoint
   - Stage:Defense Evasion
   dataset:
-  - UPDATE_DATASET_URL
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/wmi_impersonate/sysmon.log
   impact: 50
   kill_chain_phases:
   - Exploitation