PowerShell: bypassing detection via a nonstandard -EncodedCommand

Attack Techniques & Methods2026-10-23, 12:39
Most detection tools look for the string -enc in the command line, sometimes -e, and sometimes the full -EncodedCommand. But PowerShell does not treat this flag as a word. It treats it as a parameter name, accepts any prefix it can resolve unambiguously, ignores case, and accepts certain characters in place of the leading hyphen.
What exactly PowerShell accepts If you encode a harmless command and pass it to PowerShell using different spellings of the flag, PowerShell 7.6.6 accepts the following: -e, -ec, -en, -enc, -enco, -encod, -encode, -encoded, -encodedc, -EncodedCommand — in any combination of uppercase and lowercase letters. PowerShell also accepts /enc, --enc, and enc preceded by a typographic dash: a short one (en dash), a long one (em dash), or a horizontal bar. Three other dash-like characters are rejected: the figure dash, the Unicode hyphen, and the minus sign. Spellings longer than the name, such as -encodedcommandx, are also rejected.
The dashes matter. A command line copied from a document, a chat message or phishing lure may pick up typographic dashes along the way. A detection rule that looks for a space followed by a hyphen will miss these variants.
How this is used in an attack
  1. Payload preparation. The command is encoded as expected by -EncodedCommand: first in UTF-16LE, then in base64. The payload is often encoded again: the decoded command passes a second base64 string to FromBase64String, and the result is passed to Invoke-Expression.
  2. Launch obfuscation. Instead of the full flag, the command line uses an accepted prefix or a variant with a slash, a double hyphen, or a typographic dash. To PowerShell, it resolves to the same parameter; to detection, it is a different string.
  3. Execution. The process starts normally, without errors. The encoded command executes even though a rule tailored to -enc failed to catch it.
What an attacker needs to know • PowerShell version. The testing was performed on PowerShell 7.6.6. Windows PowerShell 5.1, which is still widely used by attacker tooling, needs to be tested separately in your own environment. • Payload length. Encoding increases the command’s size: UTF-16 doubles the number of bytes, and base64 adds another third. A short command can become noticeably longer. • Logging. If script block logging is enabled on the host, the decoded text may appear in event 4104. This does not eliminate command-line obfuscation, but it makes the payload easier to inspect.
Article: https://ridgelinecyber.com/blog/encoded-powershell-spellings-your-detection-misses/
Vendors
Products