During a threat hunt in Microsoft Defender XDR Advanced Hunting, you need to detect adversaries using WMI (Windows Management Instrumentation) for remote command execution and lateral movement. You want to capture events such as WMI process creation, WMI event subscription registration, and other WMI-related activity that is not always represented as a standard process spawn. Which table should you query to reliably surface these WMI-specific activity types?