diff --git a/file-stream-creation-hash.md b/file-stream-creation-hash.md
index 90d4707..a4aac75 100644
--- a/file-stream-creation-hash.md
+++ b/file-stream-creation-hash.md
@@ -1,14 +1,9 @@
 File Stream Creation Hash
 =========================
 
-Sysmon will log EventID 15 for the creation of Alternate Data Streams.
-This is an old technique where many vendors already monitor for the
-creation of ADS on files where the alternate stream is a PE executable.
-Attackers have changed to use alternate streams to hide information and
-to store other payloads that are not PE executables (DLL, Scripts)
+Sysmon will log **EventID 15** for the creation of Alternate Data Streams (ADS). This is an old technique where many vendors already monitor for the creation of ADS on files where the alternate stream is a PE executable. Attackers have changed to use alternate streams to hide information and to store other payloads that are not PE executables (DLL, Scripts).
 
-Each record in NTFS on a drive is subdivided into a list of variable
-length Attributes:
+Each record in NTFS on a drive is subdivided into a list of variable length attributes:
 
 * \$STANDARD\_INFORMATION
 
@@ -31,13 +26,11 @@ attributes
 
 * Alternate streams are named ones.
 
-Since streams are part of the NTFS structure directories may have an AD,
-we can use PowerShell to look at a file with the single default unamend
-:\$DATA stream
+Since streams that are part of the NTFS structure directories may have an AD, we can use PowerShell to look at a file with the single default unamend :\$DATA stream:
 
 ![stream1](./media/image41.png)
 
-File with a second named stream
+File with a second named stream:
 
 ![stream2](./media/image42.png)
 
@@ -55,31 +48,16 @@ Oddvar Moe
 
 The fields for the event:
 
-* **RuleName**: Name of rule that triggered the event.
-
+* **RuleName**: Name of rule that triggered the event
 * **UtcTime**: Time in UTC when event was created
-
-* **ProcessGuid**: Process Guid of the process that created the named
-    file stream
-
-* **ProcessId**: Process ID used by the OS to identify the process
-    that created the named file stream
-
-* **Image**: File path of the process that created the named file
-    stream
-
+* **ProcessGuid**: Process GUID of the process that created the named file stream
+* **ProcessId**: Process ID used by the OS to identify the process that created the named file stream
+* **Image**: File path of the process that created the named file stream
 * **TargetFilename**: Name of the file
-
 * **CreationUtcTime**: File download time
+* **Hash**: Full hash of the file with the algorithms in the HashType field
 
-* **Hash**:Full hash of the file with the algorithms in the HashType
-    field
-
-The number of processes that create alternate streams should be low and
-easy excluded. Normally mail clients and browsers are the main
-generators of this event in normal operation to set the Zone attribute.
-Because of this a maintenance process is recommended when leveraging
-these filters.
+The number of processes that create alternate streams should be low and easily excluded. Mail clients and browsers are the main generators of this event in normal operation to set the Zone attribute; Because of this, a maintenance process is recommended when leveraging these filters.
 
 ![process](./media/image43.png)