PowerShell Base64 Encoded Command Execution
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicating the use of Base64 encoded commands. Adversaries often use Base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by signature-based methods and to evade basic command-line logging. This detection specifically looks for the '-EncodedCommand', '-enc', or '-ec' flags (and their variations in casing) which are used to execute Base64 encoded strings as PowerShell commands.
Microsoft Sentinel (KQL)
