Potemkin Loader Base64 Encoded PowerShell Execution

nomit vyas@xoxo

•updated Jun 25, 2026•1•0•9

Detects the execution of PowerShell with a Base64-encoded command line originating from Windows Explorer, a behavior consistent with the Potemkin Loader and ClickFix attack campaigns used to bypass string-based detection.