PowerShell Launched with Encoded Command Argument

Ankit Mehta@Secvyn

•updated Jun 29, 2026•2•0•4

Detects instances of PowerShell or PowerShell Core (pwsh) launched with encoded command line arguments (-encodedcommand, -enc, -ec). This is a common technique used by attackers to obfuscate malicious scripts and payloads by passing them as Base64 encoded strings to avoid simple static analysis.