PowerShell launched with an encoded command

Threat behaviour covered

Attackers pass Base64-encoded PowerShell on the command line to hide the script from casual inspection and from simple string matching. The rule flags PowerShell started with an encoded-command flag.

Detection logic

title: PowerShell Launched With Encoded Command
id: eecf4138-be9c-46f4-aaf8-f78d1372bc28
status: experimental
description: Detects powershell.exe or pwsh.exe started with an encoded command flag.
author: WMouton
date: 2026/10/03
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_flag:
        CommandLine|contains:
            - ' -enc '
            - ' -EncodedCommand '
            - ' -ec '
    condition: all of selection_*
falsepositives:
    - Management and deployment tools that wrap scripts in encoded commands
level: medium

Data sources

• Windows process creation events (Sysmon event ID 1 or Security event ID 4688 with command-line auditing enabled)

False positives and tuning

• Software deployment and configuration management agents commonly use encoded commands; baseline the parent processes and allow-list them.

Limitations

• Does not catch scripts passed in other ways (a file, stdin or an obfuscated flag spelling). Pair it with PowerShell script block logging (event ID 4104).