detect squiblytwo using wmic original filename, format in cmdline and dll loading

Detect-SquiblyTwo.ps1

### ref: https://twitter.com/dez_/status/986614411711442944

Write-Host "Current Pid: " $Pid
(Get-Process -Id $pid).priorityclass = "RealTime"
$Query = 'SELECT * FROM __InstanceCreationEvent WITHIN 0.0001 WHERE TargetInstance ISA "Win32_Process"'

$action = {
    $e = $Event.SourceEventArgs.NewEvent.TargetInstance    
    $fmt = 'ProcessStarted: (ID={0,5}, Parent={1,5}, cmdline={2}, ExecutablePath="{3}, Name={4}")'
    $msg = $fmt -f $e.ProcessId, $e.ParentProcessId, $e.CommandLine, $e.ExecutablePath, $e.Name                  
    Write-host -ForegroundColor GREEN $msg

    $processId = $e.ProcessId
    $cmdline = $(Get-WmiObject Win32_Process -Filter "ProcessId = '$processId'" | Select-Object CommandLine).CommandLine
    $process = Get-Process -id $processId
    if($process -eq $null) {
        Write-host "error getting process"
        return
    }
    $ofn = $(Get-ItemProperty -Path $process.path).VersionInfo.OriginalFilename
    $modules = $process.modules.filename
    if(
        $ofn -like "wmic*" -and 
        ($modules -like "*jscript.dll" -or
        $modules -like "*vbscript.dll") -and
        $cmdline -like "*format*"){
        Write-host -ForegroundColor Red "GOTCHA: " $processid $ofn $cmdline
    }
}            
Register-WmiEvent -Query $Query -SourceIdentifier Detect-SquiblyTwo -Action $Action
# To unregister run:
#     Unregister-Event -SourceIdentifier  Detect-SquiblyTwo