Detecting Suspicious Base64 Encoded PowerShell Commands with Defender XDR KQL

PowerShell remains an attacker favorite for post-exploitation, staging beacons, and memory execution. Adversaries regularly utilize the -EncodedCommand (or abbreviated -e, -enc) parameter to pass Base64-encoded strings, hiding script blocks from basic string filters.

Here is how to hunt for malicious encoded PowerShell activity across your fleet with Defender XDR.

Table & Data Requirements

• Microsoft Defender for Endpoint: DeviceProcessEvents

Threat Hunting KQL Query

// Detect Encoded PowerShell Execution and Inspect Initiating Processes
let timeRange = 7d;
DeviceProcessEvents
| where TimeGenerated >= ago(timeRange)
| where FileName in~ ("powershell.exe", "pwsh.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any ("-encodedcommand", "-enc", "-e ", "-en ", "-enco ", "-encoded ")
| extend ExtractedBase64 = extract(@"-(?:e|enc|encodedcommand)\s+([A-Za-z0-9+/=]+)", 1, ProcessCommandLine)
| where isnotempty(ExtractedBase64) and strlen(ExtractedBase64) > 20
| extend DecodedCommand = base64_decode_tostring(ExtractedBase64)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, DecodedCommand
| order by TimeGenerated desc

In-Depth Analysis

• Regular Expression Flag Capture: The regex -(?:e|enc|encodedcommand)\s+([A-Za-z0-9+/=]+) captures the full Base64 blob regardless of shorthand parameter variation.
• base64_decode_tostring(): Native KQL function that extracts and translates the ASCII/Unicode payload directly within your Sentinel or Defender hunting console.
• Parent Process Context: Legitimate system management tools (like SCCM, Intune, or WSUS) invoke PowerShell. Correlating against InitiatingProcessFileName immediately clarifies if the parent was explorer.exe, w3wp.exe, or cmd.exe.

Investigation Checklist

• If parent is an Office application (winword.exe, excel.exe), treat as high-fidelity malicious macro or exploit behavior.
• If decoded content downloads remote payloads via Invoke-WebRequest or Net.WebClient, isolate the machine immediately.

MITRE ATT&CK Mapping

• Tactic: Execution (TA0002), Defense Evasion (TA0005)
• Technique: Command and Scripting Interpreter: PowerShell (T1059.001), Obfuscated Files or Information (T1027)