Detects blocking of process creations originating from PSExec and WMI commands
Read the full analysis on IntelFusions