Added signature that hits on when winmgmts is used

[cccs-kevin]

As per https://docs.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-with-vbscript, this is a sys admin toolkit who's use is suspicious.