PowerShell decodes -EncodedCommand reading inherited env-var payload paths (LausivLoader-style handoff)

Arnold Chan@slaz

•updated Sep 19, 2026•0•0•2

Detects the execution of base64 encoded PowerShell commands initiated by conhost.exe with the --headless flag. The decoded command contains specific suspicious patterns, including accessing environment variables, reading file content, and deleting files, which is characteristic of malicious scripts attempting to stealthily interact with the environment.