Application Terminated Via Wmic.EXE — Detection Rule

Detects calls to the "terminate" function via wmic in order to kill an application

Read the full analysis on IntelFusions