Suspicious Scripting in a WMI Consumer — Detection Rule

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Read the full analysis on IntelFusions