added office 2016 baseline

windows/security/threat-protection/change-history-for-threat-protection.md

@@ -12,6 +12,12 @@ ms.date: 10/31/2017
 # Change history for threat protection
 This topic lists new and updated topics in the [Threat protection](index.md) documentation.
 
+## February 2018
+
+New or changed topic | Description
+---------------------|------------
+[Security Compliance Toolkit](security-compliance-toolkit-10.md) | Added Office 2016 Security Baseline.
+
 ## January 2018
 |New or changed topic |Description |
 |---------------------|------------|

windows/security/threat-protection/security-compliance-toolkit-10.md

@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
 ms.localizationpriority: high
 ms.author: sagaudre
 author: brianlic-msft
-ms.date: 10/16/2017
+ms.date: 02/16/2018
 ---
 
 # Microsoft Security Compliance Toolkit 1.0
@@ -32,6 +32,9 @@ The Security Compliance Toolkit consists of:
     -   Windows Server 2016
     -   Windows Server 2012 R2
 
+-   Microsoft Office Security Baselines
+    -   Office 2016 
+
 -   Tools
     -   Policy Analyzer tool
     -   Local Group Policy Object (LGPO) tool

windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md

@@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
 author: tedhardyMSFT
-ms.date: 10/27/2017
+ms.date: 02/16/2018
 ---
 
 # Use Windows Event Forwarding to help with intrusion detection
@@ -636,9 +636,9 @@ Here are the minimum steps for WEF to operate:
     <!-- Detect User-Mode drivers loaded - for potential BadUSB detection. -->
     <Select Path="Microsoft-Windows-DriverFrameworks-UserMode/Operational">*[System[(EventID=2004)]]</Select>
   </Query>
-<Query Id="14" Path=" Windows PowerShell">
+<Query Id="14" Path="Windows PowerShell">
     <!-- Legacy PowerShell pipeline execution details (800) -->
-    <Select Path=" Windows PowerShell">*[System[(EventID=800)]]</Select>
+    <Select Path="Windows PowerShell">*[System[(EventID=800)]]</Select>
   </Query>
 </QueryList> 
 ```