Glossary
Encoded command (-EncodedCommand)
A PowerShell parameter that takes a Base64 string of UTF-16LE command text, used to pass scripts that survive quoting — and to obscure intent.
-EncodedCommand is a powershell.exe (and pwsh) parameter that runs a command supplied as Base64 of its UTF-16LE bytes. It is often shortened to -enc or -e. The legitimate purpose is to pass a command with quotes, braces or line breaks through another shell or a management tool without it being mangled. The same property makes it the most common way to hide a malicious one-liner from a quick glance at a process command line.
Why it matters in investigations
An encoded command is not malicious by itself, but it is rare in hand-typed administration and common in malware launchers, so it deserves a look every time. Where you see it depends on the artifact: script block logging usually records the block after decoding, while the command line in classic-log events 400 and 800, PSReadLine history and transcripts keeps the encoded form, so you have to decode it there.
Decoding is a pure text operation: Base64-decode the argument, then read the bytes as UTF-16LE. It never runs the command. The result is frequently another layer, such as a gzip or deflate stream, [char] codes, string concatenation or the -f format operator, each of which can also be reversed as text.
Example
A typical launcher recorded in the HostApplication field of an event 400:
powershell.exe -nop -w hidden -enc VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAHMAeQBuAHQAaABlAHQAaQBjACAAcwBhAG0AcABsAGUAJwA=
It decodes to Write-Output 'synthetic sample'. Note the repeating A characters in the Base64: they come from the zero high byte of each ASCII character in UTF-16LE, and are a quick visual tell. The parser decodes the argument, shows each layer, and also flags the hidden window that accompanies it.
Related terms
- Download cradle, the payload most often hidden this way
- Invoke-Expression (IEX), which runs decoded strings
- Execution policy bypass, typically on the same command line
- Windows PowerShell classic log, where the encoded command line is recorded
Paste an encoded command into the de-obfuscation view of the PowerShell Parser, and read decoding encoded commands and obfuscation for every layer in detail.