Invoke-Obfuscation Via Use MSHTA - PowerShell Module — Detection Rule

Detects Obfuscated Powershell via use MSHTA in Scripts

Read the full analysis on IntelFusions