Potemkin Loader - Base64 Payload Execution

Ibrahim Saud@tektrix

•updated Jun 22, 2026•5•0•55

Detects PowerShell executing Base64-encoded commands, often used by malware like Potemkin Loader (ClickFix payload), to evade basic string matching. The detection specifically looks for PowerShell processes initiated by explorer.exe with a command line containing a Base64-encoded string.