PowerShell Base64 decode one-liner writing payload to %APPDATA%

ills3c Intel&Coffee@Ills3C

•updated 10 days ago•1•0•8

Detects PowerShell execution involving Base64 decoding or certutil decoding combined with writing files to the AppData directory using .NET I/O methods or PowerShell cmdlets.