DLL Execution Via Register-cimprovider.exe — Detection Rule

Detects using register-cimprovider.exe to execute arbitrary dll file.

Read the full analysis on IntelFusions