I came across this list of articles while learning more about powershell and it’s use by cyber criminals. The list was aggregated by Jonathan S. Weissman, so credit to him for the great links and to the authors of each article.
I found it to be a great reading list on this topic and I hope you do as well.