Suspicious Start-Process PassThru — Detection Rule

Powershell use PassThru option to start in background

Read the full analysis on IntelFusions