PowerShell Encoded Command Execution

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•6

Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.