From 14553d505f9de6c380522050d3ef899143c3fe7b Mon Sep 17 00:00:00 2001
From: "@" <@>
Date: Tue, 22 Sep 2020 16:14:33 -0500
Subject: [PATCH] reformat

---
 DefenseEvasion.md | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/DefenseEvasion.md b/DefenseEvasion.md
index 0fdd500..81047ae 100644
--- a/DefenseEvasion.md
+++ b/DefenseEvasion.md
@@ -19,17 +19,12 @@ The below query will find and remote content downloads from DesktopImgDownldr or
 ### T1548.002 Bypass User Access Control
 Atomics: [T1548.002](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1548.002/T1548.002.md)
 
-Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types.
-`Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths wer ControlSet001\Service\bam\State\UserSettings\GUID\...`
+Detection of UAC bypass through tampering with Shell Open for .ms-settings or .msc file types. Beyond this Atomic test, and to further UAC bypass detection, the below query includes detection for CMSTPLUA COM interface abuse by GUID. See [Security-in-bits](https://www.securityinbits.com/malware-analysis/uac-bypass-analysis-stage-1-ataware-ransomware-part-2/#footnote) for more info about CMSTPLUA COM abuse.
+
+**Noted issues with Sentinel Agent 4.3.2.86 detecting by registry key. All registry key paths were ControlSet001\Service\bam\State\UserSettings\GUID\...**
 
 ```
-SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command"
-```
-
-To further UAC bypass detection, the below query will detect CMSTPLUA COM interface abuse by GUID and can be combined with the above. See [Security-in-bits](https://www.securityinbits.com/malware-analysis/uac-bypass-analysis-stage-1-ataware-ransomware-part-2/#footnote) for more.
-
-```
-TgtProcDisplayName = "COM Surrogate" AND TgtProcCmdLine ContainsCIS "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}"
+(SrcProcCmdLine ContainsCIS "ms-settings\shell\open\command" OR SrcProcCmdLine ContainsCIS "mscfile\shell\open\command") OR (TgtProcDisplayName = "COM Surrogate" AND TgtProcCmdLine ContainsCIS "{3E5FC7F9-9A51-4367-9063-A120244FBEC7}")
 ```
 
 ### T1218.003 CMSTP