ATT&CK T1059.001 - PowerShell Encoded Command Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP requests where the URI contains the string "-EncodedCommand" case-insensitively. This pattern is commonly associated with PowerShell commands that are base64 encoded, often used by attackers to obfuscate malicious scripts. The rule specifically looks for this string in the HTTP URI, indicating an attempt to download or execute an encoded PowerShell command.