huntrule

Suspicious PowerShell Encoded Command Execution

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-05
Updated
2026-10-05
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects powershell.exe or pwsh.exe launched with an EncodedCommand argument, an obfuscation technique used to hide the actual command from simple string matching and log inspection. Encoded PowerShell is a frequent component of maldoc and post-exploitation chains highlighted in threat hunting hypotheses. While some administrative tooling uses encoded commands, their presence warrants decoding and review.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Malicious Office Application Spawning Command Interpreter
Suspicious Office Application Spawning Script Interpreter
Suspicious Microsoft Word Spawning PowerShell
Suspicious PowerShell Download Cradle Writing Executable To Windows Temp
Malicious IIS w3wp Worker Spawning Command Interpreter via SharePoint Web Shell
Malicious Office Application Spawning PowerShell with Encoded Command
Suspicious Web Browser Spawning Scripting or Command Interpreter (via process_creation)
Malicious PowerShell Spawned by File Explorer via FileFix Social Engineering (via process_creation)
Suspicious Scheduled Task Creation in Public Writable Directory via schtasks (via process_creation)
Suspicious PowerShell Encoded Command Execution
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.