Encoded PowerShell Execution for Backdoor Staging (UNC1549)

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•10

Detects the execution of PowerShell with the encoded command parameter (-encodedcommand or -enc), followed by a substantial base64-encoded string. This is a common technique used by attackers to obfuscate malicious PowerShell scripts, bypass signature-based detection, and execute payloads in memory.