Obfuscated PowerShell -enc Command with Hidden Window or Download Cradle

Georgios Maragos@Gmarak

•updated Jul 7, 2026•5•0•16

Detects the execution of PowerShell with the '-enc' parameter, indicating base64 encoded input, coupled with either hidden window execution flags or known network download cmdlets. This pattern is commonly used by adversaries to execute obfuscated, second-stage malicious payloads while minimizing visibility on the endpoint. Legitimate administrative activities (e.g., those performed by SCCM or MSIExec) are excluded to reduce false positives.