WMIC Unquoted Services Path Lookup - PowerShell — Detection Rule

Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts