MSI Spawned Cmd and Powershell Spawned Processes

This rule looks for Windows Installer service (msiexec.exe) spawning command line and/or powershell that spawns other processes