From 542f38ff7157eabdb4b6aa573ce072c519d69ddc Mon Sep 17 00:00:00 2001
From: Jarrod-L <48501608+Jarrod-L@users.noreply.github.com>
Date: Tue, 11 Feb 2020 13:00:50 -0600
Subject: [PATCH] small typo fixes in registry-actions.md

---
 registry-actions.md | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/registry-actions.md b/registry-actions.md
index 8494ea4..8556a87 100644
--- a/registry-actions.md
+++ b/registry-actions.md
@@ -1,13 +1,14 @@
 Registry Actions
 ================
 
-Sysmon has the capability to monitor for three major actions against Registry
+Sysmon has the capability to monitor for three major actions against the Registry
 
 * **EventID 12** - Registry object added or deleted
 
 * **EventID 13** - Registry value set
 
 * **EventID 14** - Registry object renamed
+
 The Windows Registry has been a source of information gathering, persistence, storage, and configuration control for attackers since its wider use introduction in Windows NT 4.0/Windows 95.
 
 Sysmon uses abbreviated versions of Registry root key names, with the following mappings:
@@ -81,7 +82,7 @@ In registry events, the value name is appended to the full key path with a \"\\\
 
 Default key values are named \"\\(Default)\"
 
-When filtering for keys or values in HKCU, use **contains** or **end with** when filtering against **TargetObject** since the SID of the user is appended after the Hive name.
+When filtering for keys or values in HKCU, use **contains** or **ends with** when filtering against **TargetObject** since the SID of the user is appended after the Hive name.
 
 ![HKCU Test](./media/image51.png)