Suspicious PowerShell Parameter Substring — Detection Rule

Detects suspicious PowerShell invocation with a parameter substring

Read the full analysis on IntelFusions