Base64-Encoded PowerShell with Network Connection

Jorden Smith@Jorden

•updated Jan 8, 2026•0•37

Detects PowerShell processes using base64-encoded commands that establish outbound network connections within 5 minutes, indicating potential tool transfer or C2 activity. This rule correlates two base rules: one for base64-encoded PowerShell process creation and another for PowerShell network connections.