Encoded command
Detects PowerShell executing with an -EncodedCommand argument, which is frequently used to obfuscate malicious scripts.
What it detects
Detects PowerShell executing with an -EncodedCommand argument, which is frequently used to obfuscate malicious scripts. Legitimate administrative use exists but should be reviewed.
MITRE ATT&CK mapping
False positives and triage
Some deployment tooling uses encoded PowerShell legitimately. Correlate with the invoking process and user before escalating.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/powershell_encoded_command.yaml, licensed under the Apache License 2.0.
id: windows.powershell.encoded_command
version: 1.0.0
status: stable
severity: high
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1059.001, T1027]
description: |
Detects PowerShell executing with an -EncodedCommand argument, which is frequently used to
obfuscate malicious scripts. Legitimate administrative use exists but should be reviewed.
match:
event_category: script
event_action: script_executed
provider: PowerShell
command_line_regex: "(?i)-EncodedCommand"
false_positive_guidance: |
Some deployment tooling uses encoded PowerShell legitimately. Correlate with the invoking
process and user before escalating.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.