Base64-encoded PowerShell/shell execution

powershell_encoded_command

Runs a base64-encoded command through powershell -EncodedCommand (Windows) or a base64 pipe into sh (macOS/Linux). The payload only prints a marker and enumerates the OS version; the obfuscation itself is what should be flagged.

Severity medium how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1027.010	Command Obfuscation	Defense Evasion	coverage statistics
T1059.001	PowerShell	Execution	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other obfuscation and scripting tests

Other tests in the Obfuscation and scripting category.
Test	What it does	Severity
AMSI test sample execution amsi_test_string	Passes Microsoft's published AMSI test sample string to PowerShell. A working Antimalware Scan Interface provider must refuse the script, so a clean r…	medium
Character-obfuscated command execution cmd_obfuscated_exec	Executes a recon command hidden with caret escaping and environment-variable substitution on Windows, or quote splitting on macOS/Linux — the string-o…	medium
Download cradle pattern powershell_download_cradle	Uses the Net.WebClient download-cradle pattern (Windows) or a curl-into-shell pipeline (macOS/Linux) against a harmless connectivity endpoint. The fet…	medium

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.