Detects execution of powershell scripts via Runscripthelper.exe
Read the full analysis on IntelFusions