Windows base64-encoded PowerShell from Windows Registry (T1027)

Danny Y@zendannyy

•updated Jun 20, 2026•0•0•3

Detects 1027 test "Execute base64-encoded PowerShell from Windows Registry" (Obfuscated Files or Information) using command-line and process indicators derived from executor behavior.