Can your SOC see a command that arrives unreadable?
One real attacker move, a safe way to run it on a machine you own, and the detection that closes the gap — in that order, so you leave with better coverage than you arrived with.
technique T1059.001 · PowerShellseen in Turlawhere any Windows box
What this is about
Can your SOC see a PowerShell command that decodes itself?
PowerShell will happily take its instructions as base64 and decode them itself. That is a legitimate feature — it survives quoting and line breaks — and it is also the single most common way an attacker's command reaches a machine in a form that nothing in between can read. The command line is logged, but what it says is unreadable at the moment it matters.
The detection takes the honest route: it does not try to decode anything, it watches for the decode itself. A command line that contains the decoding call is a command line that is hiding its own contents, whatever those contents turn out to be.
The detection watches one thing: a PowerShell command line that decodes a base64 string before running it.
This is not hypothetical
The group tracked as Turla is documented using PowerShell on the systems it compromises. Encoded PowerShell is what lets an operator paste one line into a foothold and have a full script run, without ever writing that script to disk where a scanner could look at it.
There is no file to find afterwards and no binary to block — PowerShell is part of Windows. The same construction you are about to run, with a harmless string inside it.
The actor above is named in MITRE ATT&CK’s own Procedure Examples for this technique; the link is where you can read it. Nothing on this page discloses a move an attacker does not already have — it just makes sure the defender has it too.
Command-line logging captures the encoded form. Without a detection that notices the encoding, you have the evidence and none of the meaning.
Nothing is written to disk
The script never becomes a file, so there is nothing for a file scanner to examine and nothing left behind to find later.
The decode is the tell
You cannot judge the payload at the moment it runs. You can notice that a command line is carrying one — that is a signal you can act on.
The test
Run the real thing. Safely. On a box you own.
Run the same construction an intruder runs, with a harmless string inside it, then open your alerts.
01
Run a command that decodes itself
The script launches PowerShell with a command line that decodes a short base64 string and prints it. This is the moment your SOC should notice a self-decoding command.
02
Look at what was logged
The output is one harmless word. What matters is the command line your logging captured — unreadable until something decodes it, which is exactly the attacker's advantage.
03
Check your alerts
Open your SOC or EDR. Did the encoded PowerShell command fire — or did an unreadable instruction run without comment?
test-your-soc-powershell-encoded.ps1 · PowerShell · a machine you own
# test-your-soc-powershell-encoded.ps1 — run on a machine you own.
# Safe: decodes one short, harmless string and prints it. Nothing is written, downloaded or changed.
# STEP 1 - the actual technique: a PowerShell command line that decodes its own contents.
powershell -NoProfile -Command "[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('U09D'))"
# STEP 2 - open your SOC / EDR. Did an encoded PowerShell command alert?
The encoded string decodes to three plain letters, which are printed and nothing more. Nothing is downloaded, written to disk, installed or changed, so there is nothing to undo and no admin rights are needed. -NoProfile means your own PowerShell profile is not loaded either.
Reading the result — honestly
Something fired
Your tooling watches for command lines that decode their own contents
Good — an attacker pasting an encoded script into a foothold would surface the same way. On to the next one.
Silence
The self-decoding command ran unseen — now you know
Not a verdict on your team; a specific, fixable gap you just found in a minute. The detection below closes it.
Straight with you: we never see your alerts — you’re the judge, which is also why we never touch your data. And a lab isn’t production; a test box often logs differently than the real fleet. "It fired" means your EDR flagged the decoding call on the command line — note that legitimate automation sometimes decodes strings too, and that an attacker can obfuscate the decoding call itself, so this rule is a floor rather than a ceiling. Script block logging is what gets you the decoded contents. Treat a pass as a reason to go check prod, not a finish line.
How to catch it
Missed it? Here’s the fix — take it straight to your SOC.
Copy this to your detection team
The logic is public and every major SIEM already supports it. Here it is in Sigma, the open, vendor-neutral format your team can translate into whatever you run.
proc_creation_win_powershell_frombase64string.yml
title: Base64 Encoded PowerShell Command Detectedid: e32d4572-9826-4738-b651-95fa63747e8astatus: testdescription: Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded stringreferences: - https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639author: Florian Roth (Nextron Systems)date: 2020-01-29modified: 2023-01-26tags: - attack.stealth
- attack.t1027
- attack.execution
- attack.t1140
- attack.t1059.001
logsource: category: process_creation product: windowsdetection: selection: CommandLine|contains: '::FromBase64String(' condition: selectionfalsepositives: - Administrative script libraries
level: highregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_frombase64string/info.yml
If your test came back silent, that rule is the whole fix. Drop it into your SIEM, or send your provider this page — “we ran this, nothing fired, here’s the detection.” Either way your coverage is better tonight than it was this morning. That’s the point.
A new one every week
This is technique 12 of many.
Each one is a real attacker move, a safe way to try it, and the detection to close the gap. Run them over a few weeks and you’ll learn more about your real coverage than any dashboard has told you.
Curious how a system catches all of these at once, out of the box? That’s what we build — meet Mobula →
Credit & sources
The technique and the incident are documented by MITRE ATT&CK (T1059.001) and the sources linked above. The detection is expressed in Sigma, the open detection format maintained by the SigmaHQ community, so any team can use it freely; its author is credited above under DRL 1.1.
We show you public attacker tradecraft and public detection logic, and hand you both. Nothing here reveals anything an attacker doesn’t already have — it just makes sure the defender has it too.
CYRAY · MOBULA — SECURITY OPERATIONS, ORCHESTRATED BY AI