Analytics BIOC Low

PowerShell runs suspicious base64-encoded commands

Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
Attacker's goals:

Run code to perform actions or download other malicious programs.

Investigative actions:

Check if the initiator process is malicious. Check for other operations by the PowerShell instance.

Test period:
N/A (single event)
Deduplication:
1 Day
2 variations:
  • PowerShell runs rare base64-encoded command via remote causality actor Medium (parent: Low)
  • PowerShell runs rare base64-encoded command by windows built-in scripting engine High (parent: Low)