PowerShell Launched by Explorer with Obfuscated Command Line

Jorden Smith@Jorden

•updated Feb 10, 2026•3•0•31

This rule detects PowerShell or PowerShell Core processes launched by explorer.exe that contain highly obfuscated command lines. The obfuscation is identified by either an unusually long sequence of spaces (100 or more) or a sequence of 50 or more spaces followed by a hash and a drive letter (e.g., '# C:\'). This pattern is often used by malware to hide malicious commands from casual inspection and some security tools.