anchor.diff:  malicious scripts using `.dll` libraries, even on machines that otherwise
   disallow such scripts.
   
  -One common variant of `regsvr32` misuse is a
  +One common variant of regsvr32 misuse is a
   https://attack.mitre.org/techniques/T1218/010/[Squiblydoo attack]. In a
   Squiblydoo attack, a `regsvr32.exe` command uses the `scrobj.dll` library to
   register and run a remote script. These commands often look like this:
  
positive.code: [[eql-ex-threat-detection-setup]]
  === Setup
  
  This tutorial uses a test dataset for `regsvr32` misuse from
  https://github.com/redcanaryco/atomic-red-team[Atomic Red Team]. The dataset has
  been normalized and mapped to use fields from the {ecs-ref}[Elastic Common
  Schema (ECS)], including the `@timestamp` and `event.category` fields. The
  dataset includes events that imitate behaviors related to `regsvr32` misuse, as
  documented by the https://attack.mitre.org[MITRE ATT&CK®] knowledge base.
  
  To get started, download and index the dataset:
  
negative.code: 
  This example tutorial shows you how you can use EQL to detect security threats
  and other suspicious behavior. In the scenario, you're tasked with detecting
  https://attack.mitre.org/techniques/T1218/010/[regsvr32 misuse] in Windows
  event logs.
  
  `regsvr32.exe` is a built-in command-line utility used to register `.dll`
  