Suspicious PowerShell Base64 Decoding

Kaung Khant Ko@kaungkhantko

•updated Apr 1, 2026•1•0•82

Identifies the execution of PowerShell with suspicious base64 decoding activity. This behavior is often observed during malware installation leveraging PowerShell.