diff --git a/PhD/seminar/biblio.yml b/PhD/seminar/biblio.yml
new file mode 100644
index 0000000..4ba11e4
--- /dev/null
+++ b/PhD/seminar/biblio.yml
@@ -0,0 +1,12 @@
+mitre_masquerade:
+ type: Web
+ title: "Masquerading: Match Legitimate Name or Location"
+ serial-number: T1036.005
+ author: MITRE | ATT&CK
+ url: https://attack.mitre.org/techniques/T1036/005/
+
+mount:
+ type: web
+ title: "Hiding Linux Processes with Blind Mounts"
+ author: Hal Pomeranz
+ url: https://righteousit.com/2024/07/24/hiding-linux-processes-with-bind-mounts/
diff --git a/PhD/seminar/images/linux.svg b/PhD/seminar/images/linux.svg
new file mode 100644
index 0000000..c38dd8c
--- /dev/null
+++ b/PhD/seminar/images/linux.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/PhD/seminar/images/windows.svg b/PhD/seminar/images/windows.svg
new file mode 100644
index 0000000..050e8d0
--- /dev/null
+++ b/PhD/seminar/images/windows.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/PhD/seminar/seminar.typ b/PhD/seminar/seminar.typ
index 67c57b7..d8d824a 100644
--- a/PhD/seminar/seminar.typ
+++ b/PhD/seminar/seminar.typ
@@ -29,7 +29,18 @@
#slide(title:"State of the IDS")[
// Process masquerading is trivialy posible and used by many attacks (Mitre AttCK list)
+#line-by-line[
+- #text(weight:"bold")[Known Attacks] #cite(label("mitre_masquerade"), supplement:"MITRE"): AcroRD32.exe (Adobe), kb-10233.exe (Windows Update), mfevtpse.exe (McAfee).
+- #text(weight:"bold")[Technics:]
+ - #box(baseline: 60%, height:2em, image("images/linux.svg", height:100%)): Bind Mounts @mount, #text(fill:red)[find more]
+
+
+ - #box(baseline: 60%, height:2em, image("images/windows.svg", height:100%)): msdtc.exe , #text(fill:red)[find more]
]
+
+]
+
+
#slide(title:"State of the IDS")[
// Countermeasure to process masquerading
Listed by MITRE|ATT&CK:
@@ -85,4 +96,5 @@ Power is:
]
#slide(title:"Future Developements")[
+#bibliography("biblio.yml")
]