diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
index c9f7fa8e9b..fe3b1d84aa 100644
--- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml
+++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml
@@ -223,16 +223,18 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="wuapp.exe" OR process_name="wuauclt.exe" OR process_name="wusa.exe"
   OR process_name="xcopy.exe" OR process_name="xpsrchvw.exe" OR process_name="xwizard.exe";
 
-  | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 |
-  union $cond_6 | where process_path!="c:\\windows\\system32" AND process_path!="c:\\windows\\syswow64"
-  | eval start_time = timestamp, end_time = timestamp, entities = mvappend(device,
-  user), body = "TBD" | into write_ssa_detected_events();'
+  | from $cond_1 | union $cond_2 | union $cond_3 | union $cond_4 | union $cond_5 | union $cond_6 
+  | | where process_path NOT LIKE "%\\windows\\system32%" OR process_path NOT LIKE "%\\windows\\syswow64%"  
+  | eval start_time=timestamp, end_time=timestamp, entities=mvappend(device, user), body=create_map(["process_path", process_path, "process_name", process_name])
+  | into write_ssa_detected_events();'
 how_to_implement: Collect endpoint data such as sysmon or 4688 events.
 known_false_positives: None
 references: []
 tags:
   analytic_story:
   - Windows Defense Evasion Tactics
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log
   cis20:
   - CIS 8
   kill_chain_phases:
diff --git a/tests/endpoint/ssa___system_process_running_unexpected_location.test.yml b/tests/endpoint/ssa___system_process_running_unexpected_location.test.yml
index a45260a4d3..1b1d33dac1 100644
--- a/tests/endpoint/ssa___system_process_running_unexpected_location.test.yml
+++ b/tests/endpoint/ssa___system_process_running_unexpected_location.test.yml
@@ -1,10 +1,9 @@
 name: System Process Running from Unexpected Location - SSA Unit Test
 tests:
-  - name: System Process Running from Unexpected Location - SSA
+  - name: System Process Running from Unexpected Location
     file: endpoint/ssa___system_process_running_unexpected_location.yml
-    pass_condition: '@count_gt(0)'
-    description: Test process running from other locations
+    pass_condition: '@count_eq(0)'
+    description: Test System Process Running from an unexpected location 
     attack_data:
       - file_name: windows-security.log
-        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-security.log
-        source: WinEventLog:Security
\ No newline at end of file
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/windows-security.log