Unusual CIM Method Invocation
The rule detects the execution of PowerShell where the command line includes invoke-CimMethod. This specifically highlights the programmatic invocation of CIM methods, alerting analysts to potential WMI-based attacks or unauthorized administrative actions being performed via script.
Splunk (SPL)
