New ActiveScriptEventConsumer Created Via Wmic.EXE — Detection Rule

Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence