Suspicious Processes Spawned by WinRM

Detects suspicious processes including shells spawnd from WinRM host process