Always Install Elevated MSI Spawned Cmd And Powershell — Detection Rule

Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Read the full analysis on IntelFusions