32-bit PowerShell Invocation on 64-bit OS with Encoded Command

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Detects the invocation of the 32-bit PowerShell executable (from SysWOW64) via cmd.exe with a Base64 encoded command, which can be used to bypass 64-bit hooks and execute malicious payloads.