WMI registration

Detects scenarios where an attacker createsan instance of a WMI class using tools like WMImplant or PowerLurk.