From 310f5ddcbcff339dc03e20c6e95c612449273621 Mon Sep 17 00:00:00 2001
From: Hossam Ehab <82971998+0xHossam@users.noreply.github.com>
Date: Sun, 21 Jun 2026 00:34:56 +0300
Subject: [PATCH] add resources

---
 README.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/README.md b/README.md
index 8115799..5796382 100644
--- a/README.md
+++ b/README.md
@@ -96,3 +96,13 @@ That rule is scoped to Comodo-specific behavior, not the direct PTY execution pa
 ## detection
 
 Elastic will probably cover this in a day.
+
+-- 
+
+## resources
+
+* [https://learn.microsoft.com/en-us/windows/win32/api/shobjidl/nf-shobjidl-ihweventhandler-initialize](https://learn.microsoft.com/en-us/windows/win32/api/shobjidl/nf-shobjidl-ihweventhandler-initialize)
+* [https://learn.microsoft.com/en-us/windows/win32/shell/how-to-register-a-handler-for-a-device-event](https://learn.microsoft.com/en-us/windows/win32/shell/how-to-register-a-handler-for-a-device-event)
+* [https://lolbas-project.github.io/lolbas/Libraries/Shell32/](https://lolbas-project.github.io/lolbas/Libraries/Shell32/)
+* [https://attack.mitre.org/techniques/T1218/011/](https://attack.mitre.org/techniques/T1218/011/)
+* [https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn/](https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn/)