From 4b54eebda95719c0f6072bbe6803cbdc14d303ae Mon Sep 17 00:00:00 2001
From: Justin Hall <Justinha@microsoft.com>
Date: Tue, 5 Jun 2018 16:02:13 -0700
Subject: [PATCH] fixed case for EventID

---
 ...windows-event-forwarding-to-assist-in-intrusion-detection.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
index 8e5b6d0232..e42efc4ec8 100644
--- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
+++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md
@@ -630,7 +630,7 @@ Here are the minimum steps for WEF to operate:
   </Query>
   <Query Id="12" Path="Microsoft-Windows-PowerShell/Operational">
     <!-- PowerShell execute block activity (4103), Remote Command(4104), Start Command(4105), Stop Command(4106) -->
-    <Select Path="Microsoft-Windows-PowerShell/Operational">*[System[(EventID=4103 or EventId=4104 or EventId=4105 or EventId=4106)]]</Select>
+    <Select Path="Microsoft-Windows-PowerShell/Operational">*[System[(EventID=4103 or EventID=4104 or EventID=4105 or EventID=4106)]]</Select>
   </Query>
   <Query Id="13" Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">
     <!-- Detect User-Mode drivers loaded - for potential BadUSB detection. -->