Batch File Launching Hidden PowerShell with EP Bypass and Base64 Payload

Duo Tech@duotech

•updated Jul 9, 2026•2•0•4

Detects the execution of PowerShell with specific flags to bypass execution policy and hide the window, commonly used to execute encoded payloads. This rule monitors for PowerShell processes spawned by suspicious parent processes such as 'cmd.exe' or 'ElevatorShellCode.exe' that include parameters like '-ep bypass', '-w hidden', and base64-encoded strings.