Most Popular Detection 2026: Obfuscated and Encoded PowerShell Execution (T1059.001, T1027)

Ibrahim Saud@tektrix

•updated 12 days ago•1•0•2

Detects suspicious PowerShell execution patterns involving encoded commands, hidden window styles, or common download cradles combined with code obfuscation techniques. This rule monitors PowerShell ScriptBlock Logging (Event ID 4104) for combinations of indicators often used by threat actors to evade detection, such as Base64-encoded strings, hidden execution flags, network download utilities, and script obfuscation techniques.