huntrule

Suspicious Encoded PowerShell Command Execution

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-20
Updated
2026-10-20
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell invoked with an encoded-command switch, which conceals the executed script from casual inspection. Malicious LNK files analyzed by Unit 42 launch cmd to run PowerShell with EncodedCommand payloads. Base64-encoded PowerShell is a common obfuscation and execution technique that merits review.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)
Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index
Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)
Suspicious PowerShell Spawned from PyInstaller MEI Extraction Folder (via process_creation)
Suspicious PowerShell Encoded Command Execution
Suspicious PowerShell Invoke-Expression with Replace Obfuscation
Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell
Suspicious Python Interpreter Launching Encoded PowerShell via subprocess
Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)
Suspicious Encoded PowerShell Command Execution
Pivot detection · T1027 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.