diff --git a/README.md b/README.md
index 3211cdf..63f20d2 100644
--- a/README.md
+++ b/README.md
@@ -1958,6 +1958,10 @@ _return-to-libc techniques_
hlldz/Invoke-Phant0m |
Windows Event Log Killer |
+
+ huntresslabs/evading-autoruns |
+ Slides and reference material from Evading Autoruns presentation at DerbyCon 7 (September 2017) |
+
JohnLaTwC/PyPowerShellXray |
Python script to decode common encoded PowerShell scripts |