Add references section to README

Added a references section to the README file.

README.md

@@ -22,12 +22,15 @@ Authors: Max Hirschberger & Ogulcan Ugur
 6. [Advantages of Detection Avoidance by this Technique](#6-advantages-of-detection-avoidance-by-this-technique)
 7. [Detection Approach](#7-detection-approach)
 8. [Conclusion](#8-conclusion)
+9. [References](#9-references)
 ---
 
 ## 1. Introduction
 
 P³-Shellcode Loader is a loader that implements a code injection technique which leverages the Process Parameters structure (Process Parameter Poisoning) as an execution and staging location for shellcode injection into remote processes, without triggering common detection mechanisms.
 
+A similar concept was described by the security researcher [modexp](https://modexp.wordpress.com/category/windows/), who demonstrated that the arguments passed to the CreateProcess-API can be leveraged for this purpose [1].
+
 ---
 
 ## 2. Typical Process Injection and Involved System APIs
@@ -556,3 +559,9 @@ There are several suspicious indicators generated by this technique, that can be
  
 In summary, attackers can bypass modern security solutions through new ideas and small modifications, either by developing new techniques or by reapplying old techniques in novel ways. 
 Therefore it is important to continuously develop new detection rules and not solely rely on an existing solution.
+
+---
+
+## 9. References
+
+[1] https://web.archive.org/web/20241211190548/https://modexp.wordpress.com/2020/07/31/wpi-cmdline-envar/