diff --git a/atomics/T1112/T1112.yaml b/atomics/T1112/T1112.yaml
index 6f672071..52a29f8c 100644
--- a/atomics/T1112/T1112.yaml
+++ b/atomics/T1112/T1112.yaml
@@ -695,7 +695,9 @@ atomic_tests:
 - name: Enabling Restricted Admin Mode via Command_Prompt
   auto_generated_guid: fe7974e5-5813-477b-a7bd-311d4f535e83
   description: |
-    Enabling Restricted Admin Mode via Command_Prompt,enables an attacker to perform a pass-the-hash attack using RDP
+    Enabling Restricted Admin Mode via Command_Prompt,enables an attacker to perform a pass-the-hash attack using RDP.
+    
+    See [Passing the Hash with Remote Desktop](https://www.kali.org/blog/passing-hash-remote-desktop/)
   supported_platforms:
   - windows
   executor: