WMI Permanent Event Subscription - Sysmon

Windows Management Instrumentation Event Subscription , Event Triggered Execution

Unusually Long Command Line

System Processes Run From Unexpected Locations

Masquerading , Rename System Utilities

Single Letter Process On Endpoint

User Execution , Malicious File

Shim Database File Creation

Application Shimming , Event Triggered Execution