The Windows command security checker now detects wmic in addition to Invoke-CimMethod and Invoke-WmiMethod. The wmic tool can spawn arbitrary processes via process call create, execute XSL scripts via /format or /translate, or write arbitrary files via /output, /append, or /record.
Evidence
Updated WMI checker (search for "wmic can spawn arbitrary processes (process call create)")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.