federal-homelab

PowerShell Encoded Command

Field Value
ATT&CK technique T1059.001 — Command and Scripting Interpreter: PowerShell
Tactic Execution
Log source Windows Security event log (WS01), PowerShell Operational
Index lab_win
Severity High
Status Validated — 2026-09-24
Author Samuel Emerson
Created 2026-09-24
Validated 2026-09-24 — evidence

Hypothesis

powershell.exe -EncodedCommand <base64> runs a Base64-encoded script without it ever appearing in plain text on the command line. It is a staple of loaders and living-off-the-land activity, because it defeats casual command-line inspection and simple keyword filters. Legitimate software occasionally uses encoded commands, but on a workstation an interactive user launching one is unusual and worth review.

Windows records the launch as Security event 4688 (with command-line auditing enabled), so the encoded flag and its argument are visible there. PowerShell script-block logging (event 4104) records the decoded script separately, which is what confirms what actually ran.

Detection logic

index=lab_win source="XmlWinEventLog:Security" EventCode=4688
    (NewProcessName="*\\powershell.exe" OR NewProcessName="*\\pwsh.exe")
| regex CommandLine="(?i)\s[-/](e|ec|en(c(o(d(e(d(c(o(m(m(a(n(d)?)?)?)?)?)?)?)?)?)?)?)?)\s+[A-Za-z0-9+/=]{16,}"
| table _time host SubjectUserName ParentProcessName NewProcessName CommandLine

PowerShell accepts any unambiguous abbreviation of -EncodedCommand (-e, -en, -enc, …), so the pattern matches the flag at any length, followed by a Base64 string of at least 16 characters. It also accepts the / switch form. Confirming what ran uses 4104:

index=lab_win source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" EventCode=4104
| table _time host ScriptBlockText

Field reference

Field Source Meaning
EventCode=4688 Security log A new process was created
NewProcessName 4688 The executable path — powershell.exe or pwsh.exe
CommandLine 4688 Full command line, including the encoded flag and payload
ParentProcessName 4688 What launched PowerShell
EventCode=4104 PowerShell Operational Script-block text — the decoded command

Validation

Item Detail
Atomics Atomic Red Team master, downloaded 2026-09-24
Test #17 PowerShell Command Execution · a538de64-1c74-46ed-aa60-b995ed302598
Executed at 2026-09-24 15:35:15 CDT (execution log)
Command observed powershell.exe -e <base64>, parent cmd.exe. Decoded, the payload was a benign Write-Host 'Hello, from PowerShell!' — the encoded form is what the detection keys on, not the content
Detection fired Yes — scheduled run at 15:40:01, 1 result (alert log)
Time to detect 4 min 44 s
Evidence 4688 event · screenshot · alert screenshot
Cleanup None required; the test starts no persistent process

False positives

Scenario Likelihood Tuning
Management tooling running encoded commands Medium in production Allowlist the parent process or the service account
Software installers using encoded bootstrap commands Low–medium Allowlist by parent image after a baseline
Administrator pasting an encoded one-liner Low Correlate with the 4104 decoded content before escalating

Response guidance

  1. Pull the matching 4104 event and read the decoded script.
  2. Check the parent process — an Office app or a browser launching encoded PowerShell is far more serious than a console session.
  3. Look for network connections (Sysmon event 3) from the PowerShell process.
  4. If unexplained: isolate the host, preserve the script-block content, and pivot to the parent process tree.

Gaps

NIST 800-53 mapping

Control Relevance
AU-2 / AU-12 Audit of process creation and script-block content
SI-4 System monitoring for malicious execution
SI-3 Malicious code — encoded execution is a common delivery method