diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md
index 68401d1360..57e45c13c2 100644
--- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md
+++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md
@@ -488,40 +488,40 @@ Simulate execution (SimExec) is a mitigation for 32-bit applications only. This
 
 The APIs intercepted by this mitigation are:
 
-- LoadLibraryA
-- LoadLibraryW
-- LoadLibraryExA
-- LoadLibraryExW
-- LdrLoadDll
-- VirtualAlloc
-- VirtualAllocEx
-- NtAllocateVirtualMemory
-- VirtualProtect
-- VirtualProtectEx
-- NtProtectVirtualMemory
-- HeapCreate
-- RtlCreateHeap
-- CreateProcessA
-- CreateProcessW
-- CreateProcessInternalA
-- CreateProcessInternalW
-- NtCreateUserProcess
-- NtCreateProcess
-- NtCreateProcessEx
-- CreateRemoteThread
-- CreateRemoteThreadEx
-- NtCreateThreadEx
-- WriteProcessMemory
-- NtWriteVirtualMemory
-- WinExec
-- CreateFileMappingA
-- CreateFileMappingW
-- CreateFileMappingNumaW
-- NtCreateSection
-- MapViewOfFile
-- MapViewOfFileEx
-- MapViewOfFileFromApp
-- LdrGetProcedureAddressForCaller
+- `LoadLibraryA`
+- `LoadLibraryW`
+- `LoadLibraryExA`
+- `LoadLibraryExW`
+- `LdrLoadDll`
+- `VirtualAlloc`
+- `VirtualAllocEx`
+- `NtAllocateVirtualMemory`
+- `VirtualProtect`
+- `VirtualProtectEx`
+- `NtProtectVirtualMemory`
+- `HeapCreate`
+- `RtlCreateHeap`
+- `CreateProcessA`
+- `CreateProcessW`
+- `CreateProcessInternalA`
+- `CreateProcessInternalW`
+- `NtCreateUserProcess`
+- `NtCreateProcess`
+- `NtCreateProcessEx`
+- `CreateRemoteThread`
+- `CreateRemoteThreadEx`
+- `NtCreateThreadEx`
+- `WriteProcessMemory`
+- `NtWriteVirtualMemory`
+- `WinExec`
+- `CreateFileMappingA`
+- `CreateFileMappingW`
+- `CreateFileMappingNumaW`
+- `NtCreateSection`
+- `MapViewOfFile`
+- `MapViewOfFileEx`
+- `MapViewOfFileFromApp`
+- `LdrGetProcedureAddressForCaller`
 
 If a ROP gadget is detected, the process is terminated.
 
@@ -543,40 +543,40 @@ Validate API invocation (CallerCheck) is a mitigation for return-oriented progra
 
 The APIs intercepted by this mitigation are:
 
-- LoadLibraryA
-- LoadLibraryW
-- LoadLibraryExA
-- LoadLibraryExW
-- LdrLoadDll
-- VirtualAlloc
-- VirtualAllocEx
-- NtAllocateVirtualMemory
-- VirtualProtect
-- VirtualProtectEx
-- NtProtectVirtualMemory
-- HeapCreate
-- RtlCreateHeap
-- CreateProcessA
-- CreateProcessW
-- CreateProcessInternalA
-- CreateProcessInternalW
-- NtCreateUserProcess
-- NtCreateProcess
-- NtCreateProcessEx
-- CreateRemoteThread
-- CreateRemoteThreadEx
-- NtCreateThreadEx
-- WriteProcessMemory
-- NtWriteVirtualMemory
-- WinExec
-- CreateFileMappingA
-- CreateFileMappingW
-- CreateFileMappingNumaW
-- NtCreateSection
-- MapViewOfFile
-- MapViewOfFileEx
-- MapViewOfFileFromApp
-- LdrGetProcedureAddressForCaller
+- `LoadLibraryA`
+- `LoadLibraryW`
+- `LoadLibraryExA`
+- `LoadLibraryExW`
+- `LdrLoadDll`
+- `VirtualAlloc`
+- `VirtualAllocEx`
+- `NtAllocateVirtualMemory`
+- `VirtualProtect`
+- `VirtualProtectEx`
+- `NtProtectVirtualMemory`
+- `HeapCreate`
+- `RtlCreateHeap`
+- `CreateProcessA`
+- `CreateProcessW`
+- `CreateProcessInternalA`
+- `CreateProcessInternalW`
+- `NtCreateUserProcess`
+- `NtCreateProcess`
+- `NtCreateProcessEx`
+- `CreateRemoteThread`
+- `CreateRemoteThreadEx`
+- `NtCreateThreadEx`
+- `WriteProcessMemory`
+- `NtWriteVirtualMemory`
+- `WinExec`
+- `CreateFileMappingA`
+- `CreateFileMappingW`
+- `CreateFileMappingNumaW`
+- `NtCreateSection`
+- `MapViewOfFile`
+- `MapViewOfFileEx`
+- `MapViewOfFileFromApp`
+- `LdrGetProcedureAddressForCaller`
 
 If a ROP gadget is detected, the process is terminated.