Execution of Possible Suspicious Mofcomp (via process_creation)

This rule detects execution of the "mofcomp" utility as a child of an anomalous shell or script running utility or by having an anomalous path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers misuse this utility to install hostile MOF scripts