WMI Event Subscription — Detection Rule

Detects creation of WMI event subscription persistence method

Read the full analysis on IntelFusions