diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting  .md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting  .md
index b1018f5e79..df80d3bdec 100644
--- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting  .md	
+++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting  .md	
@@ -23,7 +23,7 @@ This capability is supported beginning with Windows version 1607.
 
 Here is a simple example query that shows all the WDAC events generated in the last seven days from machines being monitored by Windows Defender ATP:
 
-```
+```cs
 MiscEvents
 | where EventTime > ago(7d) and
 ActionType startswith "AppControl"