anchor.diff:  
   [discrete]
   [[eql-ex-get-a-count-of-regsvr32-events]]
  -=== Get a count of `regsvr32.exe` events
  +=== Get a count of `regsvr32` events
   
   Since you're looking for `regsvr32` misuse, start by getting a count of any
   events associated with a `regsvr32.exe` process.
  
positive.code: 
  . Download the https://raw.githubusercontent.com/elastic/elasticsearch/{branch}/docs/src/test/resources/normalized-T1117-AtomicRed-regsvr32.json[`normalized-T1117-AtomicRed-regsvr32.json`] dataset.
  
  . Index the data into the `my-index-000001` index with the following
  <<docs-bulk,bulk API>> request:
  +
  [source,sh]
  ----
  
negative.code: remote file
  
  To match, each event in the sequence must share the same process ID, recorded in
  the `process.pid` field.
  
  Based on the command line value seen in the previous result, you can expect to
  find a match. However, the sequence query isn't designed for that specific
  