diff --git a/Get-InjectedThreadEx.cpp b/Get-InjectedThreadEx.cpp
index 4a4df9c..a39747a 100644
--- a/Get-InjectedThreadEx.cpp
+++ b/Get-InjectedThreadEx.cpp
@@ -14,7 +14,6 @@
 //    original
 //     - not MEM_IMAGE
 //    new
-//     - not MEM_COMMIT
 //     - MEM_IMAGE and Win32StartAddress is on a private (modified) page
 //     - MEM_IMAGE and x64 dll and Win32StartAddress is CFG violation or suppressed export
 //     - MEM_IMAGE and Win32StartAddress is in a suspicious module
diff --git a/Get-InjectedThreadEx.png b/Get-InjectedThreadEx.png
new file mode 100644
index 0000000..bd8cd42
Binary files /dev/null and b/Get-InjectedThreadEx.png differ
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a137b6a
--- /dev/null
+++ b/README.md
@@ -0,0 +1,17 @@
+![screenshot](Get-InjectedThreadEx.png)
+
+# Get-InjectedThreadEx
+
+[Get-InjectedThreadEx.exe](https://github.com/jdu2600/Get-InjectedThreadEx/releases/latest) scans all running threads looking for suspicious Win32StartAddresses.
+
+Win32Startaddress anomalies include -
+ * not MEM_IMAGE
+ * non-MEM_IMAGE return address within the first 5 stack frames
+ * MEM_IMAGE and on a private (modified) page
+ * MEM_IMAGE and x64 dll and not a valid indirect call target
+ * MEM_IMAGE and unexpected Win32 dll
+ * MEM_IMAGE and x64 and unexpected prolog
+ * MEM_IMAGE and preceded by unexpected bytes
+ 
+See my [BSides Canberra 2023 talk](https://github.com/jdu2600/conference_talks/blob/main/2023-09-bsidescbr-GetInjectedThreadEx.pdf) and [Elastic Security Labs blog](https://www.elastic.co/security-labs/get-injectedthreadex-detection-thread-creation-trampolines) for more details.
+