FortiBleed PowerShell hidden-window Base64-encoded execution

Ibrahim Saud@tektrix

•updated Jul 3, 2026•4•0•8

Detects the execution of PowerShell with a hidden window (-w 1) and base64 encoded arguments containing a specific string (JABVAHIAbAA). This combination is commonly used by malicious scripts or fileless malware loaders to execute obfuscated code silently.