Encoded PowerShell commands
PowerShell accepts a whole script as a base64 string of UTF-16LE text through -EncodedCommand, which hides the script from anyone reading the command line. A post-exploitation framework started its agent this way on eight machines, sometimes directly and sometimes through cmd.exe wrappers whose command lines carry the same string. Find every process whose command line carries an encoded command. The clean Windows 10 client also runs PowerShell, with hidden windows, and other programs that take short flags.
Hint 1
PowerShell accepts shortened parameter names: -e, -en, -enc and -EncodedCommand all work.
Hint 2
The encoded text itself can be matched: base64offset with wide finds a plain string inside UTF-16LE base64.
The rule runs in this browser; it is saved here so you can come back to it.
Events
2,351 events. Search filters the table; it does not affect the result.