Obfuscated PowerShell EncodedCommand with long Base64 payload

Ibrahim Saud@tektrix

•updated Sep 18, 2026•1•0•2

Detects the execution of PowerShell with encoded commands that are unusually long (over 300 characters). Adversaries often use Base64 encoding to obfuscate malicious PowerShell scripts, and long encoded strings are a strong indicator of non-interactive or automated command execution, such as during the initial stage of an attack.