Home / Stories / Topic

Execution

Topic • 1 Story

Dikshant Lather · Sep 25, 2026

Detecting Suspicious Base64 Encoded PowerShell Commands with Defender XDR KQL

Halt fileless execution and command obfuscation by spotting encoded PowerShell flags (-enc, -encodedcommand) with Defender for Endpoint KQL queries.

Endpoint Detection 2 min read

0 0