anchor.diff:  
   [discrete]
   [[eql-ex-get-a-count-of-regsvr32-events]]
  -=== Get a count of `regsvr32` events
  -
  -Since you're looking for `regsvr32` misuse, start by getting a count of any
  +=== Get a count of regsvr32 events
  +
  +Since you're looking for regsvr32 misuse, start by getting a count of any
   events associated with a `regsvr32.exe` process.
   
   The following <<eql-search-api,EQL search API>> request uses an EQL query to
  
positive.code: [[eql-ex-check-for-command-line-artifacts]]
  === Check for command line artifacts
  
  Based on your previous query, you know `regsvr32` processes were associated with
  143 events. But how was `regsvr32.exe` first called? And who called it?
  
  `regsvr32` is a command-line utility so it may help to narrow your results to
  processes where the command line was used.
  
  Update the previous EQL query as follows:
  
  
negative.code: [[eql-ex-threat-detection-setup]]
  === Setup
  
  This tutorial uses a test dataset for regsvr32 misuse from
  https://github.com/redcanaryco/atomic-red-team[Atomic Red Team]. The dataset has
  been normalized and mapped to use fields from the {ecs-ref}[Elastic Common
  Schema (ECS)], including the `@timestamp` and `event.category` fields. The
  dataset includes events that imitate behaviors of a Squiblydoo attack, as
  documented by the https://attack.mitre.org[MITRE ATT&CK®] knowledge base.
  
  To get started, download and index the dataset:
  