Detect Encoded PowerShell Commands in CrowdStrike Falcon Process Events

title: Encoded PowerShell Command in CrowdStrike Falcon Process Events
id: 56e5fdb9-ffaa-4f19-a4c7-a2b1ad59b59f
status: experimental
description: >
  Detects a process start (ProcessRollup2) whose command line runs PowerShell
  with -EncodedCommand or one of the short forms PowerShell accepts for it.
  The flag takes a base64 string, so the command that actually runs cannot be
  read in the log. Attackers use it to hide download cradles and in-memory
  payloads from simple string matching.
references:
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1027/010/
author: LogTriage
date: 2026/10/19
logsource:
  product: crowdstrike
  service: fdr
detection:
  process_start:
    event_simpleName: 'ProcessRollup2'
    CommandLine|contains: 'powershell'
  encoded_flag:
    CommandLine|contains:
      - ' -e '
      - ' -ec '
      - ' -en '
      - ' -enc '
      - ' -encodedcommand '
  condition: process_start and encoded_flag
falsepositives:
  - Deployment and management tools that pass scripts as base64
  - Installers and administrator scripts using -EncodedCommand on purpose
level: medium
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027.010

What this rule detects

PowerShell’s -EncodedCommand parameter runs a script passed as base64-encoded UTF-16LE text. The script never appears in readable form on the command line, which is exactly why attackers use it. It defeats string matching on download cradles, reverse shells and in-memory loaders.

This rule fires on a Falcon process-start event (ProcessRollup2) whose command line runs PowerShell with -EncodedCommand or one of its accepted short forms: -e, -ec, -en or -enc.

Detection logic

Two selections, both required:

1. process_start: event_simpleName is ProcessRollup2, Falcon’s process-start event, and CommandLine contains powershell. Requiring the process-start event means the rule matches the command line a process actually ran with, not another event that only quotes it.
2. encoded_flag: CommandLine contains -e, -ec, -en, -enc or -encodedcommand. The spaces on both sides keep -ExecutionPolicy and -Encoding from matching.

The condition is process_start and encoded_flag.

Validated against a real sample

Validated against crowdstrike_detections.json (shipped with LogTriage). The rule fires on one of its five events: a ProcessRollup2 at 2024-01-15 14:30:01 UTC on DESKTOP-VICTIM for user CORP\jsmith, where cmd.exe runs cmd.exe /c powershell -enc JABjAGwAaQBlAG4AdA. The argument is truncated, but what survives decodes to the start of $client, the opening of the common PowerShell reverse-shell one-liner.

The other four events are the follow-through: a connection from the same host to 185.220.101.42:4444, Falcon’s own Cobalt Strike Beacon detection two minutes later, a failed ANONYMOUS LOGON on DC-01, and activity from C:\Temp\mimikatz.exe. They do not match this rule, by design. The encoded command is the earliest signal in the chain, and the one you can see in raw process telemetry before any vendor verdict arrives.

It stays silent on crowdstrike_normal.json, whose only process start is chrome.exe --no-first-run, alongside an ordinary HTTPS connection, an interactive logon and a DNS lookup.

False positives

Legitimate encoded PowerShell is common enough to tune for. Deployment and management agents, some installers and administrators’ own scripts use it to avoid quoting problems. Decode the argument before you judge it. Then baseline the parent processes that legitimately do this in your environment (in ProcessRollup2, link the event to its parent process via ParentProcessId) and exclude them, rather than raising the severity of the whole rule.