PowerShell EncodedCommand with Large Base64 Payload (>200 chars)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the execution of PowerShell with an encoded command flag (e.g., -EncodedCommand, -e, -ec) where the command string exceeds 200 characters. This pattern is commonly used to obfuscate malicious PowerShell scripts, payloads, or downloader cradles.