Analytics BIOC
Low
✕
PowerShell runs suspicious base64-encoded commands
Running PowerShell with a base64-encoded payload in the command line is often used by attackers to evade detection.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
Attacker's goals:
Run code to perform actions or download other malicious programs.
Investigative actions:
Check if the initiator process is malicious. Check for other operations by the PowerShell instance.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day
2 variations:
- PowerShell runs rare base64-encoded command via remote causality actor Medium (parent: Low)
- PowerShell runs rare base64-encoded command by windows built-in scripting engine High (parent: Low)