Service Started/Stopped Via Wmic.EXE — Detection Rule

Detects usage of wmic to start or stop a service

Read the full analysis on IntelFusions