WMI spawning PowerShell seen in various attacks

rules/windows/process_creation/win_wmi_spwns_powershell.yml

@@ -0,0 +1,29 @@
+title: WMI Spawning Windows PowerShell
+status: experimental
+description: Detects WMI spawning PowerShell 
+references:
+    - https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_shell_spawn_susp_program.yml
+    - https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e
+author: Markus Neis / @Karneades
+date: 2019/04/03
+tags:
+    - attack.execution
+    - attack.defense_evasion
+    - attack.t1064
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        ParentImage:
+            - '*\wmiprvse.exe'
+        Image:
+            - '*\powershell.exe'
+    filter:
+        CommandLine:
+            - '*&*'
+    condition: selection and not filter
+falsepositives:
+    - AppvClient
+    - CCM
+level: high