MATCHBOIL WMI Win32_Process creation of payload from LOCALAPPDATA
Detects WmiPrvSE.exe spawning a child process executable from a user-writable AppData\Local folder, which often results from a .NET process invoking ManagementClass(Win32_Process).Create.
Microsoft Sentinel (KQL)
