Suspicious PowerShell Encoded Command Execution

Michael Fajkus@MilesDyson

•updated Aug 4, 2025•10•5•84

Detects the use of encoded PowerShell commands often associated with obfuscated or malicious script execution. The rule targets executions of 'powershell.exe' containing suspicious keywords like 'IEX', 'Invoke-WebRequest', or 'FromBase64String', and attempts to decode any Base64-encoded payloads. Common in malware delivery and post-exploitation activity.