Detect and Decode Base64-Encoded PowerShell Commands - http
The query identifies Windows PowerShell executions using encoded commands, extracts and decodes Base64 payloads (including nested encodings), counts occurrences and unique hosts, and outputs decoded command content for analysis of potentially obfuscated activity.
CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2 event_platform=Win ImageFileName=/.*\\powershell\.exe/
| CommandLine=/.*\s+\-(e|encoded|encodedcommand|enc)\s+.*/
| length("CommandLine", as="cmdLength")
| groupby([CommandLine], function=stats([count(aid, distinct=true, as="uniqueEndpointCount"), count(aid, as="executionCount")]), limit=max)
| EncodedString := splitString(field=CommandLine, by="-e* ", index=1)
| CmdLinePrefix := splitString(field=CommandLine, by="-e* ", index=0)
| DecodedString := base64Decode(EncodedString, charset="UTF-16LE")
// Look for encoded messages in the decoded message and decode those too.
| case {
DecodedString = /encoded/i
| SubEncodedString := splitString(field=DecodedString, by="-EncodedCommand ", index=1)
| SubCmdLinePrefix := splitString(field=EncodedString, by="-EncodedCommand ", index=0)
| SubDecodedString := base64Decode(SubEncodedString, charset="UTF-16LE");
*
}
| DecodedString=/.*https?\:\/\/.*/
| table([executionCount, uniqueEndpoitnCount, DecodedString, CommandLine])
| sort(executionCount, order=desc)Reference: GitHub CrowdStrike/logscale-community
Detect_and_Decode_Base64-Encoded_PowerShell_Commands-http.yml
CrowdStrike
Hunting
Endpoint
Insight
2025-10-30
2025-10-30
