PowerShell Encoded Command Execution via -EncodedCommand/-Enc/-ec

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•3

Detects the execution of PowerShell with the EncodedCommand (-enc/-e/-ec) argument, which is frequently used by adversaries to hide malicious scripts and bypass simple command-line inspection. The rule excludes processes signed by Microsoft to reduce noise from legitimate system administration scripts.