title: PowerShell Launched With Encoded Command
id: eecf4138-be9c-46f4-aaf8-f78d1372bc28
status: experimental
description: Detects powershell.exe or pwsh.exe started with an encoded command flag.
author: WMouton
date: 2026/10/03
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_flag:
        CommandLine|contains:
            - ' -enc '
            - ' -EncodedCommand '
            - ' -ec '
    condition: all of selection_*
falsepositives:
    - Management and deployment tools that wrap scripts in encoded commands
level: medium