PowerShell Memory-Only Loader: Base64 + In-Memory Execution

Ankit Mehta@Secvyn

•updated Jun 27, 2026•1•0•2

Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.