WMI Module Loaded By Uncommon Process — Detection Rule

Detects WMI modules being loaded by an uncommon process

Read the full analysis on IntelFusions