GenericPowershell

rule GenericPowershell 
{
    strings:
        $a = "PS>function"
        $b = "Invoke-Expression"
        $c = "<MS><S N="
        $d = "</MS></Obj>"
        $e = "CompileAssemblyFromSource"
        $f = "Remoting.RemoteHostMethodId"
        $g = "<resp:Arguments"
        $h = "rsp:Command"
        $i = "-EncodedCommand"

    condition:
        any of them
}