anchor.diff:  [[eql-ex-threat-detection-setup]]
   === Setup
   
  -This tutorial uses a test dataset for `regsvr32` misuse from
  +This tutorial uses a test dataset for regsvr32 misuse from
   https://github.com/redcanaryco/atomic-red-team[Atomic Red Team]. The dataset has
   been normalized and mapped to use fields from the {ecs-ref}[Elastic Common
   Schema (ECS)], including the `@timestamp` and `event.category` fields. The
  -dataset includes events that imitate behaviors related to `regsvr32` misuse, as
  +dataset includes events that imitate behaviors of a Squiblydoo attack, as
   documented by the https://attack.mitre.org[MITRE ATT&CK®] knowledge base.
   
   To get started, download and index the dataset:
  
positive.code: 
  [discrete]
  [[eql-ex-get-a-count-of-regsvr32-events]]
  === Get a count of `regsvr32` events
  
  Since you're looking for `regsvr32` misuse, start by getting a count of any
  events associated with a `regsvr32.exe` process.
  
  The following <<eql-search-api,EQL search API>> request uses an EQL query to
  
negative.code: [[eql-ex-check-for-command-line-artifacts]]
  === Check for command line artifacts
  
  Based on your previous query, you know regsvr32 processes were associated with
  143 events. But how was `regsvr32.exe` first called? And who called it?
  
  `regsvr32.exe` is a command-line utility so it may help to narrow your results
  to processes where the command line was used.
  
  Update the previous EQL query as follows:
  
  