Lesson 142 — The PowerShell Command Was Encoded

Case briefing

Stage 1 — hunt for encoded PowerShell

Start in DeviceProcessEvents. We are looking for PowerShell command lines containing common forms of the encoded-command switch.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any
    ("-EncodedCommand", "-enc", "-e ")
| project Timestamp,
          DeviceName,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          ProcessId,
          InitiatingProcessId
| order by Timestamp desc

Stage 2 — isolate the encoded token

Once encoded PowerShell is identified, extract the Base64-looking argument into its own field. This makes triage easier while retaining the full original command line alongside it.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| extend EncodedToken =
    extract(@"(?i)(?:-EncodedCommand|-enc)\s+([A-Za-z0-9+/=]+)", 1, ProcessCommandLine)
| where isnotempty(EncodedToken)
| project Timestamp,
          DeviceName,
          AccountName,
          InitiatingProcessFileName,
          ProcessCommandLine,
          EncodedToken
| order by Timestamp desc

Stage 3 — decode a copy safely

PowerShell's -EncodedCommand commonly represents Base64-encoded UTF-16LE text. Decode the captured string in a safe analysis environment. Do not execute the decoded command.

Stage 4 — reconstruct activity around execution

Now return to telemetry. The decoded command gives you a hypothesis; the device events tell you what was actually observed around the execution time.

let TargetDevice = "WS-FIN-042";
let TargetTime = datetime(2026-08-18 01:22:11);
DeviceProcessEvents
| where DeviceName =~ TargetDevice
| where Timestamp between (TargetTime - 10m .. TargetTime + 10m)
| project Timestamp,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          AccountName,
          ProcessId,
          InitiatingProcessId
| order by Timestamp asc

Stage 5 — test the network behaviour

If the decoded content references remote infrastructure, check whether network telemetry attributed to the PowerShell process supports that behaviour.

let TargetDevice = "WS-FIN-042";
let PowerShellPID = 7316;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where DeviceName =~ TargetDevice
| where InitiatingProcessId == PowerShellPID
| project Timestamp,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          RemoteUrl,
          RemoteIP,
          RemotePort,
          ActionType
| order by Timestamp asc

Agent Foskett's decoded timeline

Your evidence board

Write the finding like an investigator

Example: Microsoft Defender XDR recorded PowerShell executing on WS-FIN-042 under the j.smith account with an encoded-command argument. The original command line was preserved and a copy of the Base64 content was decoded for analysis without execution. The decoded content referenced remote script retrieval and execution behaviour. Surrounding process telemetry and network activity attributed to the PowerShell process were then reviewed to determine whether the intended behaviour was observed. The encoded argument alone is not evidence of compromise; the assessment is based on the correlation between the command's decoded intent and the endpoint telemetry.

Lesson 142 key takeaways

• Encoded PowerShell is an investigative clue, not automatic proof of malicious activity.
• Preserve the complete original ProcessCommandLine.
• Search for common encoded-command parameter forms, but expect syntax variation.
• Extracting the encoded token can make triage easier without discarding source evidence.
• Decode captured content safely; do not execute it.
• PowerShell encoded commands commonly require the correct character encoding when converted back to readable text.
• Use decoded content to identify entities and formulate hypotheses.
• Separate what a command was instructed to do from what telemetry proves actually happened.
• Correlate process and network evidence before reaching a conclusion.
• Document both supporting evidence and evidentiary limits.

Module 12 — the attack chain continues

Lesson 141 established the suspicious parent-child relationship. Lesson 142 looked inside an encoded PowerShell command and turned unreadable command-line content into investigative pivots. Next we move deeper into process relationships and ask whether the execution tree fits legitimate user behaviour.