How to defend against encoded PowerShell commands

What the attacker does

powershell.exe -EncodedCommand <text> runs a script given as base64 encoded UTF-16LE text. PowerShell also accepts short forms of the parameter (-e, -ec, -enc) and / in place of -. The script is unreadable on the command line, and quoting problems disappear, which is why attack frameworks start their agents this way. The same string often appears in a cmd.exe /c start ... wrapper as well.

What it looks like in the logs

A process creation event whose command line has the encoded parameter and a long base64 string. This is one of the starts in the recordings:

With script block logging enabled, PowerShell also writes the content of every script block it runs to its operational log (Event ID 4104), so the decoded script can be read there.

Detect

Measured on the challenge data: the rule caught 13 of 13 attack events and matched 0 of 2,321 normal events.

title: Encoded PowerShell command on the command line
id: 8c4a1e7d-2f63-4b9a-a5d0-71e3c9b2f846
status: test
description: Detects a command line that passes a base64 encoded script to PowerShell with -EncodedCommand or a short form of it (-e, -ec, -enc), including cmd.exe wrappers that carry the same string.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1027/
  - https://howdefend.com/defend/encoded-powershell/
author: Bartu Kılıç
date: 2026-10-20
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1027
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    # A short form of -EncodedCommand followed by a long base64 string. " -e" alone would also
    # match PowerShell operators such as -eq inside a -Command script.
    CommandLine|re|i: '\s[-/]e[a-z]*\s+[a-z0-9+/=]{40,}'
  condition: selection
falsepositives:
  - Management and deployment tools that pass encoded scripts (review the decoded text in script block logging)
level: medium

What the rule misses

• Scripts that are not on the command line. In the same recordings, the agent started through fodhelper.exe (a UAC bypass) read its script from the registry: powershell -NoP -NonI -W Hidden -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update); powershell -NoP -NonI -W Hidden -enc $x. The variable carries the encoded text, so the command line has no base64 string.
• PowerShell without powershell.exe. Code that loads the PowerShell engine into another process does not create a PowerShell process at all. Script block logging still records it.
• Other dash characters. Some programs accept the en dash, em dash or horizontal bar in place of -; the pattern covers - and /.

Prevent

• Record the script. Turn on script block logging (Group Policy: Windows PowerShell, Turn on PowerShell Script Block Logging) and collect Event ID 4104. It is the log that shows what an encoded command did.
• Restrict the language. When an App Control for Business or AppLocker policy is enforced, PowerShell runs in Constrained Language Mode, which blocks most of what attack tools use (arbitrary .NET types, Windows API calls).
• Remove PowerShell 2.0. The 2.0 engine has no script block logging. Microsoft removes it from Windows 11 24H2 and Windows Server 2025 starting with the August and September 2025 updates; on older versions, remove the optional feature.
• Attack surface reduction. Microsoft Defender's rule "Block execution of potentially obfuscated scripts" (5beb7efe-fd9a-4556-801d-275e5ffc04cc) targets obfuscated script content.

Practice

Write the rule yourself on the same data, with every target labelled.

Sources

• MITRE ATT&CK: T1059.001 PowerShell
• Microsoft Learn: about_Logging_Windows (script block logging)
• Microsoft Learn: about_Language_Modes
• Microsoft Support: PowerShell 2.0 removal from Windows
• Microsoft Learn: Attack surface reduction rules reference