Suspicious NewActiveScriptEventConsumer Creation Attempt through Wmic.EXE (via process_creation)

This rule detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically runs a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries frequently misuse ActiveScriptEventConsumer to maintain persistence on a compromised host by running a hostile script whenever a specific event occurs.