PowerShell EncodedCommand Decoder

How to decode an encoded PowerShell command

1. Copy the full command line from the alert, the process creation event or the EDR console and paste it into Command line or Base64. Quotes around the Base64 are fine.
2. The decoder finds the -EncodedCommand argument in any abbreviation (-e, -ec, -enc and so on, with - or /) and decodes it.
3. The status says which charset was used: UTF-16LE, as PowerShell expects, or UTF-8 when the bytes do not look like UTF-16.
4. Read the Decoded script. If it contains [Convert]::FromBase64String('…') literals, they are listed below with detected type and size. Text payloads open in the output pane, compressed ones (gzip, zlib or raw deflate, as used with GzipStream and DeflateStream) get a decompress button, and other binary payloads can be saved as a file.

A harmless example:

powershell.exe -NoP -NonI -W Hidden -Enc VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAnAGgAZQBsAGwAbwAnAA==

decodes to Write-Output 'hello'. The same text in UTF-8 Base64 would be V3JpdGUtT3V0cHV0ICdoZWxsbyc=, which PowerShell would reject or misread.

Recognizing encoded commands in logs

Because of UTF-16LE, the start of an encoded script has a recognizable Base64 form. Detection rules match on these:

These forms hold only at the very beginning. Further into the script the same word has three possible Base64 spellings, depending on its byte offset modulo 3, which is why searching logs for one spelling misses the other two.

Analyzing a suspicious command safely

Encoded commands are a standard way to hide a script from casual inspection of a process list. When one shows up in an alert:

• Decode only. This page converts text and makes no network requests besides Cloudflare’s page-view count. Do not paste the command into a PowerShell window, and never pass decoded output to iex.
• Read for intent and indicators. Note URLs, domains, IP addresses, file paths, registry keys and scheduled task names for your incident notes and blocklists.
• Look for further layers. Nested FromBase64String calls, IO.Compression.DeflateStream or GzipStream, -join over character codes and string reversal are common wrappers. Decode each layer the same way.
• Treat extracted binaries as samples. A payload saved from the nested list may be malware. Hash it and analyze it only in an isolated environment.
• Check the logs that already have the plain text. With Script Block Logging enabled, Windows records the decoded script as event 4104 in Microsoft-Windows-PowerShell/Operational. Process creation events (Security 4688 with command-line auditing, or Sysmon event 1) record the encoded command line itself.

Legitimate uses and the Encode tab

Administrators use -EncodedCommand to avoid quoting problems when a script passes through cmd.exe, a scheduled task, a remote shell or a configuration management tool. Encode script produces the argument: type the script, choose the Command prefix (powershell -NoProfile -EncodedCommand, pwsh -NoProfile -EncodedCommand, powershell -enc or Base64 only) and copy. A warning appears when the result exceeds the 8,191-character command line limit of cmd.exe.

Decoding in Python and PowerShell

import base64
script = base64.b64decode(b64).decode("utf-16-le")

$script = [Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($b64))

Both only return text. More on the encoding side is on the PowerShell Base64 page and the UTF-16 to Base64 converter.

Common problems

• The output looks like Chinese characters: UTF-8 Base64 decoded as UTF-16. The tool falls back to UTF-8 when the byte pattern does not fit UTF-16, and the status line says which charset it used.
• Invalid Base64: the command was cut by a log field limit or wrapped across lines. Join the pieces and remove anything after the Base64 that is not part of it.
• The command line does not decode at all: the Base64 may sit inside a -Command "…FromBase64String('…')…" string instead of following -EncodedCommand. Paste only the Base64 string; if it is not UTF-16 text, the Base64 decoder or Base64 to file shows what it is.

FAQ