New Process Created Via Wmic.EXE — Detection Rule

Detects new process creation using WMIC via the "process call create" flag

Read the full analysis on IntelFusions