Decoding and deobfuscation recipes as JSON you can load straight into CyberChef, each with a constructed sample and the output it should produce, so you can tell a wrong recipe from a wrong input.
A recipe is JSON you load, not a screenshot you retype. Each one ships with a constructed sample and its expected output, so when yours comes out as noise you can tell whether the recipe is wrong or the input is not what you thought.
Two operations for the layer that sits inside most PowerShell loaders: base64 that decodes to binary starting with 1F 8B. Recognise it on sight, then read the script inside.
One operation for a common trick in malicious JavaScript and HTML attachments: a string written as a list of decimal character codes so that no readable word appears in the file.
The two operations that turn the base64 after -e, -enc or -EncodedCommand into the script that ran. Short, and the one you will use most.
