diff --git a/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml b/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml
index a57382c3b5..c5c8181640 100644
--- a/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml
+++ b/detections/endpoint/ssa___windows_diskshadow_proxy_execution.yml
@@ -11,7 +11,7 @@ search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_data
 how_to_implement: To successfully implement this search you need to be ingesting information on processes that include the name of the process responsible for the changes from your endpoints into the `Endpoint_Processess` datamodel.
 known_false_positives: Administrators using the DiskShadow tool in their infrastructure as a main backup tool with scripts will cause false positives
 references:
--  
+-  https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
 tags:
   analytic_story:
   - Living Off The Land