Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Base64encodePEFile

Azure Sentinel@AzureSentinel

•updated Jun 17, 2025•0•35

Finding base64 encoded PE files header seen in the command line parameters. Tags: #fileLess #powershell.

Microsoft Sentinel (KQL)

Tags

T1059.001 - PowerShell T1027.013 - Encrypted/Encoded File T1027.009 - Embedded Payloads TA0002 - Execution TA0005 - Defense Evasion T1027.011 - Fileless Storage S0457 - Netwalker S0627 - SodaMaster T1027 - Obfuscated Files or Information T1027.001 - Binary Padding T1027.014 - Polymorphic Code T1059 - Command and Scripting Interpreter T1059.007 - JavaScript T1059.002 - AppleScript Powershell Script Execution Command Execution File Executable Detected Windows Microsoft Iis Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?