Detects Obfuscated use of Environment Variables to execute PowerShell
Read the full analysis on IntelFusions