PowerShell Invoke-CIMMethod with New-CIMSession

This analytic detects the use of `New-CIMSession` followed by `Invoke-CIMMethod` within PowerShell. This combination is significant because it mimics the behavior of `Invoke-WMIMethod`, which is often used for remote code execution, particularly via NTLMv2 pass-the-hash authentication. Detection relies on PowerShell Script Block Logging (EventCode 4104) to identify these cmdlets in the `ScriptBlockText` field. Successful exploitation could lead to unauthorized remote command execution and system control.