Powershell expression

[saniyafatima07]

closes #1032

Reduces false positives in PowerShell expression detection.
Previously, Invoke-Expression was being matched anywhere in the code, which was too broad and caused false positives.

Refined the detection by combining the most common patterns seen in malware. The updated rule now covers:

• API-based detection: Checks for PowerShell.Invoke combined with Create or AddScript.
• Command-line detection: Looks for powershell.exe along with common flags like -EncodedCommand or iex
• Script execution patterns: Matches common malware strings such as DownloadString, Invoke-WebRequest, WebClient, AmsiUtils, and amsiInitFailed
• Passes the lint test and formatted with capafmt

[saniyafatima07]

@mike-hunhoff
I have read some blogs and documentations to know about the Invoke-Expression. Based on those, I came up with the approach of checking the common patterns.

I am not very sure if this covers all possible cases and am concerned about potential false negatives if some patterns are missed.

Could you please let me know if I am on the right track or if the process needs further refinement?

Thank you for your time and guidance.