Completed changes to selection1 and selection2

changes were completed to remove ( * ) and stay within rule creation guide:
    - Image|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'

 WMIcommand|contains: 'Win32_Process\:\:Create'

rules/windows/process_creation/Monitor_WMI_Win32_Process Create_command_execution_by_Office_Applications.yml

@@ -20,12 +20,12 @@ detection:
   selection1:
     EventLog: EDR
     EventType: WMIExecution
-    WMIcommand: '*Win32_Process\:\:Create*'
+    WMIcommand|contains: 'Win32_Process\:\:Create'
   selection2:
-    - Image:
-      - '*\winword.exe'
-      - '*\excel.exe'
-      - '*\powerpnt.exe'
+    - Image|endswith:
+      - '\winword.exe'
+      - '\excel.exe'
+      - '\powerpnt.exe'
   condition: selection1 AND selection2
 falsepositives:
 - Unknown