diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml
index d05c4928b5..be436d6ce7 100644
--- a/detections/endpoint/office_product_writing_cab_or_inf.yml
+++ b/detections/endpoint/office_product_writing_cab_or_inf.yml
@@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint
   by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest
   | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly`
   count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest
+  where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") by _time span=1h Filesystem.dest
   Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)`
   | fields _time dest file_create_time file_name file_path process_name process_path
   process] | dedup file_create_time | table dest, process_name, process, file_create_time,
diff --git a/tests/endpoint/office_product_writing_cab_or_inf.test.yml b/tests/endpoint/office_product_writing_cab_or_inf.test.yml
index 5a3620f4cf..1e521d52cf 100644
--- a/tests/endpoint/office_product_writing_cab_or_inf.test.yml
+++ b/tests/endpoint/office_product_writing_cab_or_inf.test.yml
@@ -6,7 +6,7 @@ tests:
   earliest_time: '-24h'
   latest_time: 'now'
   attack_data:
-  - file_name: windows-sysmon_control.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log
     source:  XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog
\ No newline at end of file