Kimsuky NUKESPED JSE Loader Multi-Stage PowerShell Base64 Decode Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects malicious PowerShell command lines exhibiting multi-stage base64 decoding patterns characteristic of the Kimsuky NUKESPED JSE loader. The rule identifies suspicious chaining of base64 decoding (FromBase64String) with execution primitives (Invoke-Expression, IEX), unicode encoding specifications, or EncodedCommand arguments used to bypass security controls and deobfuscate stage-two payloads.