Encoded PowerShell Command in Registry Value

Jorden Smith@Jorden

•updated Jan 8, 2026•9•0•58

Detects registry values containing Base64-encoded PowerShell commands. Attackers use this technique to obfuscate malicious commands in the registry for persistence or execution.