Suspicious PowerShell Execution with Base64 Encoded Command (Windows)
Alerts on PowerShell launched with Base64-encoded command-line parameters, excluding likely Guest Configuration noise.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-01-02
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creations where PowerShell (powershell.exe or pwsh.exe) is launched with a Base64-style encoded command indicator in the command line (e.g., -e, -enc, -enco). Attackers commonly use encoded PowerShell to obscure malicious logic from casual inspection and simple string-based detections. The detection relies on process creation telemetry, matching the PowerShell executable name and specific command-line substrings while excluding events tied to known Guest Configuration worker execution paths and those containing an explicit -Encoding filter.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets
- unit42.paloaltonetworks.comhttps://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- mikefrobbins.comhttps://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_encode.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Suspicious PowerShell Execution with Base64 Encoded Command (Windows)
id: 8c309b4a-d88a-49c4-a529-713e8508a836
status: test
description: This rule flags Windows process creations where PowerShell (powershell.exe or pwsh.exe) is launched with a Base64-style encoded command indicator in the command line (e.g., -e, -enc, -enco). Attackers commonly use encoded PowerShell to obscure malicious logic from casual inspection and simple string-based detections. The detection relies on process creation telemetry, matching the PowerShell executable name and specific command-line substrings while excluding events tied to known Guest Configuration worker execution paths and those containing an explicit -Encoding filter.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets
- https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
- https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_encode.yml
author: frack113, Huntrule Team
date: 2022-01-02
modified: 2023-01-05
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains:
- " -e "
- " -en "
- " -enc "
- " -enco"
- " -ec "
filter_encoding:
CommandLine|contains: " -Encoding "
filter_azure:
ParentImage|contains:
- C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\
- \gc_worker.exe
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: fb843269-508c-4b76-8b8d-88679db22ce7
type: derived