Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Read the full analysis on IntelFusions