Update detect-office-products-spawning-wmic.md

Author: tali-ash

Execution/detect-office-products-spawning-wmic.md

@@ -10,7 +10,7 @@ The following query detects when Microsoft Office software spawns an instance of
 
 ```Kusto
 ​​// Office products spawning WMI
-ProcessCreationEvents
+DeviceProcessEvents
 | where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "outlook.exe")
 and FileName =~"wmic.exe"
 ```
@@ -39,4 +39,4 @@ This query can be used to detect the following attack techniques and tactics ([s
 
 ## Contributor info
 
-**Contributor:** Microsoft Threat Protection team
+**Contributor:** Microsoft Threat Protection team