diff --git a/tests/endpoint/overwriting_accessibility_binaries.test.yml b/tests/endpoint/overwriting_accessibility_binaries.test.yml
new file mode 100644
index 0000000000..464794939a
--- /dev/null
+++ b/tests/endpoint/overwriting_accessibility_binaries.test.yml
@@ -0,0 +1,10 @@
+name: Overwriting Accessibility Binaries Unit Test
+detections:
+- name: Overwriting Accessibility Binaries
+  file: endpoint/overwriting_accessibility_binaries.yml
+  pass_condition: '| stats count | where count > 0'
+attack_data:
+- file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1546.008/windows-sysmon.log
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog