From 47716e7a7052508ad5a30544bab8116553b68640 Mon Sep 17 00:00:00 2001
From: Filip Olszak <32537788+xinbailu@users.noreply.github.com>
Date: Sat, 10 Apr 2021 20:39:52 +0200
Subject: [PATCH 1/2] Update README.md

---
 README.md | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/README.md b/README.md
index ae4ea97..5b259f5 100644
--- a/README.md
+++ b/README.md
@@ -9,12 +9,8 @@ An accompanying blog post can be found here: https://blog.redbluepurple.io/windo
 
 ![gif](https://i.imgur.com/M9QXk1z.gif)
 
-# Implemented detection usecases 
-- [x] ALLOCVM_REMOTE_META_GENERIC
-- [ ] ALLOCVM_REMOTE_SIGNATURES
-- [ ] APC detections
-- [ ] Process hollowing detections
-- [ ] Reflective techniques
+# Adding new detections 
+Detection functions can be easily added `in DetectionLogic.cpp`, and called from `detect_event(GenericEvent evt)` for any source event type. Support for new event fields can be easily added by appending their name to the map in `GenericEvent` class declaration.
 
 # Setup instructions
 Assuming you do not have a Microsoft-trusted signing certificate:
@@ -28,8 +24,6 @@ Assuming you do not have a Microsoft-trusted signing certificate:
 # TODO
 - [x] PPL Service, event parsing 
 - [x] First detection  
-- [ ] Ingegrate Yara and scanning
-- [ ] Rewrite with OOP 
 - [ ] Detection lifecycle 
 - [ ] Risk based lifecycle 
 

From 6c6ab21b4c3ea5da633e02b325b8f585b8ec48e1 Mon Sep 17 00:00:00 2001
From: Filip Olszak <32537788+xinbailu@users.noreply.github.com>
Date: Sat, 10 Apr 2021 20:40:13 +0200
Subject: [PATCH 2/2] Update README.md

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 5b259f5..75e89b4 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ An accompanying blog post can be found here: https://blog.redbluepurple.io/windo
 ![gif](https://i.imgur.com/M9QXk1z.gif)
 
 # Adding new detections 
-Detection functions can be easily added `in DetectionLogic.cpp`, and called from `detect_event(GenericEvent evt)` for any source event type. Support for new event fields can be easily added by appending their name to the map in `GenericEvent` class declaration.
+Detection functions can be easily added in `DetectionLogic.cpp`, and called from `detect_event(GenericEvent evt)` for any source event type. Support for new event fields can be easily added by appending their name to the map in `GenericEvent` class declaration.
 
 # Setup instructions
 Assuming you do not have a Microsoft-trusted signing certificate: