diff --git a/tests/T1070.001.yml b/tests/T1070.001.yml
index 3b0d3f7264..4c77fc74a1 100644
--- a/tests/T1070.001.yml
+++ b/tests/T1070.001.yml
@@ -4,4 +4,9 @@ detections:
     pass_condition: '| stats count | where count = 4'
 description: Test Windows Event Logs cleared (atomic red team is not yet updated)
 target: default-attack-range-windows-domain-controller
-simulation_technique: 'T1551.001'
+simulation_technique: 'T1070.001'
+attack_data:
+  - file_name: windows-security.log
+    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1070.001/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog