Payload Encoder — PowerShell Encoded Command
Encoding hides the command from a human reading a command line. It does not hide it from Script Block Logging, which records the deobfuscated content at execution. If you take one thing from this tool, enable 4104.
Open in Red Team Toolkit — payloadPayload Encoder — PowerShell Encoded Command
What the attacker produced
The Payload Encoder produced a Base64-encoded PowerShell command passed via the -EncodedCommand flag (or its aliases -enc, -ec, -e). This technique hides the script body from casual inspection of the command line and bypasses simple string-match controls that look for keywords like "Invoke-Expression" or "DownloadString" in plaintext. The encoded blob is decoded by the PowerShell engine at runtime before execution, which means the malicious content never appears in the process command line — only the encoded string does.
Encoding hides the command from a human reading a command line. It does not hide it from Script Block Logging, which records the deobfuscated content at execution. If you take one thing from this tool, enable 4104.
Telemetry generated
| Log source | Field / identifier | What it shows |
|---|---|---|
| Security 4688 | CommandLine / NewProcessName | Process creation with full command line — captures powershell.exe or pwsh.exe with the -enc flag and the encoded blob. Requires "Audit Process Creation" and "Include command line in process creation events" GPO. |
| Sysmon Event 1 | OriginalFileName | Process creation with OriginalFileName read from the PE version resource — survives renaming the binary. A renamed powershell.exe still shows OriginalFileName: PowerShell.EXE. |
| PowerShell Operational 4104 | ScriptBlockText | Script Block Logging captures the FULLY DEOBFUSCATED script at execution time, regardless of how many encoding layers were applied. This is the highest-fidelity signal for encoded PowerShell. |
| PowerShell Operational 4103 | Payload / ContextInfo | Module logging records each module and function call with parameters. Complements 4104 by capturing pipeline execution details. |
Detection rules
title: PowerShell Encoded Command Execution
id: a2b3c4d5-e6f7-8901-abcd-ef0123456789
status: stable
description: Detects PowerShell launched with an encoded command argument (-enc, -encodedcommand, -ec, -e)
references:
- https://attack.mitre.org/techniques/T1059/001/
author: Cal Security & Forensics
date: 2026/08/05
tags:
- attack.execution
- attack.t1059.001
- attack.defense_evasion
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains:
- ' -enc '
- ' -encodedcommand '
- ' -ec '
- ' -e '
filter_mma:
ParentImage|contains:
- '\Microsoft Monitoring Agent\'
- '\CCM\'
condition: selection and not filter_mma
falsepositives:
- Legitimate automation using encoded commands (tune by parent process)
level: highEvasion & counters
String concatenation inside the script body to split keywords across variables before encoding.
Script Block Logging (4104) captures the reconstructed, fully-deobfuscated script at execution time regardless of how the source was assembled. Concatenation defeats string-match on the encoded blob; it does not defeat 4104.
Renaming powershell.exe to a benign-looking name (e.g. svchost.exe) to evade image-name detections.
Sysmon Event 1 records OriginalFileName from the PE version resource, which is embedded in the binary and cannot be changed by renaming. A renamed PowerShell still reports OriginalFileName: PowerShell.EXE.
Unmanaged PowerShell via direct loading of System.Management.Automation.dll into a custom host process, bypassing the powershell.exe process entirely.
Script Block Logging (4104) is engine-level, not process-level. It fires from the PowerShell runtime regardless of which host process loaded it.
AMSI patching — writing to amsiScanBuffer in memory to force AMSI_RESULT_CLEAN before the scan runs.
EDR products instrument memory writes to AMSI functions and flag tampering. Additionally, 4104 fires before AMSI is consulted, so the deobfuscated script is already logged.
Rule tuning
Preventive control
Enable Script Block Logging and Module Logging fleet-wide by GPO. Deploy Constrained Language Mode where operationally feasible. Use WDAC or AppLocker to restrict which scripts and script interpreters can run on workstations. These controls do not prevent PowerShell from running but they ensure every execution is logged at the engine level and the most dangerous capabilities are blocked.