RecipeCONSTRUCTEDUntested
PowerShell -EncodedCommand to readable script
The two operations that turn the base64 after -e, -enc or -EncodedCommand into the script that ran. Short, and the one you will use most.
2 operationschecked 2026-09-21
You are looking at this when
A PowerShell command line with -e, -en, -enc or any longer prefix of -EncodedCommand, followed by base64 in which every other character is an A. That pattern is UTF-16LE text, where each ASCII character is followed by a zero byte.
How it was checked
The sample output was confirmed by doing the same two steps in Python (base64 decode, then decode as UTF-16LE). The recipe JSON itself has not been loaded into CyberChef by whoever wrote this page: load it once with the sample and check that you get the output shown before you rely on it.
- 1From Base64
- 2Decode text
[
{
"op": "From Base64",
"args": [
"A-Za-z0-9+/=",
true,
false
]
},
{
"op": "Decode text",
"args": [
"UTF-16LE (1200)"
]
}
]Sample input (constructed)
VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAGMAbwBuAHMAdAByAHUAYwB0AGUAZAAgAHMAYQBtAHAAbABlADoAIABoAGUAbABsAG8AIABmAHIAbwBtACAAdABoAGUAIAByAGUAYwBpAHAAZQAgAGIAbwBvAGsAIgA=
Expected output
Write-Output "constructed sample: hello from the recipe book"
Why two steps and not one
-EncodedCommand takes base64 of the command as UTF-16LE, not as ASCII or
UTF-8. Decode the base64 alone and you get text with a zero byte after every
character, which most viewers render as W.r.i.t.e.-.O.u.t.p.u.t. The second
operation reads those bytes in the encoding PowerShell wrote them in.
People reach for "Remove null bytes" here instead. It appears to work and it is wrong: it destroys any character outside ASCII, so a command carrying a non-English path or a deliberately chosen Unicode lookalike comes out altered, and you will not know.
When the output is more base64
It usually is. The readable layer is commonly a second stage that decodes and
runs a third: look for FromBase64String, IO.Compression.GzipStream or
DeflateStream. Add From Base64 again, then Gunzip or Raw Inflate,
and repeat until it stops.
Do not run anything you decode. The point of decoding it here is that you do not have to.
Evidence hygiene
An encoded command from an intrusion is evidence, and the hosted CyberChef is somebody else's web page. CyberChef runs entirely in the browser and sends nothing, but the habit worth having is to download a release and open it from disk, so the question never arises. For a quick decode with nothing to load, the analyst tools on this site do base64 locally too.
If script block logging is on, event 4104 already holds this script decoded, as the engine ran it. Check there first.