PowerShell Encoded Command Execution

nomit vyas@xoxo

•updated Apr 30, 2026•1•0•52

This rule detects the execution of PowerShell with encoded commands. Adversaries often use encoded commands to obfuscate their malicious scripts and evade detection. The rule specifically looks for 'powershell.exe' in the process filename and either '-enc' or '-encodedcommand' in the command line, while excluding known legitimate uses by 'Windows Defender'.