title: PowerShell EncodedCommand Execution

id: 99410337-d137-401f-ac19-3977cfa523a4

status: experimental

description: >

  Detects PowerShell launched with an encoded command payload, frequently used to

  hide intent during initial access and execution. Pairs an -EncodedCommand style flag

  with the common evasion switches.

references:

  - https://attack.mitre.org/techniques/T1059/001/

author: Zion Boggan

date: 2026-05-12

tags:

  - attack.execution

  - attack.t1059.001

logsource:

  product: windows

  category: process_creation

detection:

  selection_img:

    - Image|endswith: '\powershell.exe'

    - Image|endswith: '\pwsh.exe'

    - OriginalFileName: 'PowerShell.EXE'

  selection_enc:

    CommandLine|contains:

      - ' -enc '

      - ' -encodedcommand '

      - ' -ec '

  selection_flags:

    CommandLine|contains:

      - ' -nop'

      - ' -noprofile'

      - ' -w hidden'

      - ' -windowstyle hidden'

  condition: selection_img and (selection_enc or selection_flags)

falsepositives:

  - Some management tooling and installers use encoded commands; baseline by parent process.

level: medium