title: PowerShell Launched With A Long Encoded Command
id: b0c3657f-7f1b-4a4b-b84f-8bf0f2b2918d
status: experimental
description: |
  Detects PowerShell started with any abbreviation of -EncodedCommand followed by at least
  forty characters of base64. PowerShell accepts every unambiguous prefix of the parameter
  (-e, -en, -enc, -enco and so on), which is why a rule that matches the literal word misses most
  real use. The length floor removes the short encoded one-liners management agents produce.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe
author: Security Artifacts
date: 2026-09-21
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    - OriginalFileName:
        - 'PowerShell.EXE'
        - 'pwsh.dll'
  selection_encoded:
    CommandLine|re: '(?i)\s[-/]e[a-z]{0,13}\s+[A-Za-z0-9+/]{40,}={0,2}'
  filter_optional_management:
    ParentImage|endswith:
      - '\CCM\CcmExec.exe'
      - '\Microsoft Intune Management Extension\AgentExecutor.exe'
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Configuration management and RMM agents that wrap scripts in -EncodedCommand. Baseline the parent images in your estate and extend the filter; do not remove the rule.
level: medium