Detects a WMI backdoor in Exchange Transport Agents via WMI event filters
Read the full analysis on IntelFusions