WMI Event Consumer Created Named Pipe — Detection Rule

Detects the WMI Event Consumer service scrcons.exe creating a named pipe

Read the full analysis on IntelFusions