PowerShell Base64-Encoded Command Execution (T1059.001)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•8•0•7

Detects the execution of PowerShell (powershell.exe or pwsh.exe) using command-line arguments typical of encoded commands, such as -enc, -EncodedCommand, or the use of 'frombase64string' within the command line. These patterns are frequently used by adversaries to hide malicious payloads and bypass simple string-based security controls.