diff --git a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml
index bba241d4c1..aa4777b88a 100644
--- a/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml
+++ b/detections/endpoint/lolbas_network_connection_on_uncommon_port.yml
@@ -162,5 +162,5 @@ tests:
         - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218/lolbas_with_network_traffic/lolbas_with_network_traffic.log
           source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
           sourcetype: XmlWinEventLog
-      expected_results: 0
+      expected_results: 1
       test_type: unit