Suspicious Encoded Scripts in a WMI Consumer — Detection Rule

Detects suspicious encoded payloads in WMI Event Consumers

Read the full analysis on IntelFusions