Suspicious PowerShell Execution with Base64 Encoded Command (Windows)

Alerts on PowerShell launched with Base64-encoded command-line parameters, excluding likely Guest Configuration noise.

FreeReviewedSigma · Medium · v1

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-02
Updated: 2026-07-30

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows process creations where PowerShell (powershell.exe or pwsh.exe) is launched with a Base64-style encoded command indicator in the command line (e.g., -e, -enc, -enco). Attackers commonly use encoded PowerShell to obscure malicious logic from casual inspection and simple string-based detections. The detection relies on process creation telemetry, matching the PowerShell executable name and specific command-line substrings while excluding events tied to known Guest Configuration worker execution paths and those containing an explicit -Encoding filter.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PsExec Service Launching Encoded PowerShell Payload

Suspicious PowerShell Remote Script Execution via IEX DownloadString

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

Suspicious Hidden PowerShell Spawned by Script Host via process_creation

Suspicious Run Key Persistence Referencing PowerShell Script via registry_set

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

Suspicious PowerShell Execution with Base64 Encoded Command (Windows)

Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

suspicious-powershell-execution-with-base64-encoded-command-windows-fb843269

title: Suspicious PowerShell Execution with Base64 Encoded Command (Windows)
id: 8c309b4a-d88a-49c4-a529-713e8508a836
status: test
description: This rule flags Windows process creations where PowerShell (powershell.exe or pwsh.exe) is launched with a Base64-style encoded command indicator in the command line (e.g., -e, -enc, -enco). Attackers commonly use encoded PowerShell to obscure malicious logic from casual inspection and simple string-based detections. The detection relies on process creation telemetry, matching the PowerShell executable name and specific command-line substrings while excluding events tied to known Guest Configuration worker execution paths and those containing an explicit -Encoding filter.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets
  - https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
  - https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_encode.yml
author: frack113, Huntrule Team
date: 2022-01-02
modified: 2023-01-05
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - " -e "
      - " -en "
      - " -enc "
      - " -enco"
      - " -ec "
  filter_encoding:
    CommandLine|contains: " -Encoding "
  filter_azure:
    ParentImage|contains:
      - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\
      - \gc_worker.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: fb843269-508c-4b76-8b8d-88679db22ce7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL