diff --git a/rules/windows/process_creation/win_susp_certutil_command.yml b/rules/windows/process_creation/win_susp_certutil_command.yml
index 26cc7c489..b643eb4fc 100644
--- a/rules/windows/process_creation/win_susp_certutil_command.yml
+++ b/rules/windows/process_creation/win_susp_certutil_command.yml
@@ -8,8 +8,6 @@ date: 2019/01/16
 modified: 2021/04/23
 references:
     - https://twitter.com/JohnLaTwC/status/835149808817991680
-    - https://twitter.com/subTee/status/888102593838362624
-    - https://twitter.com/subTee/status/888071631528235010
     - https://blogs.technet.microsoft.com/pki/2006/11/30/basic-crl-checking-with-certutil/
     - https://www.trustedsec.com/2017/07/new-tool-release-nps_payload/
     - https://twitter.com/egre55/status/1087685529016193025