Cortex XDR

Copy

> Make sure you're comfortable with the results in your own environment before using this more widely.

# Snippet - 

## Threat Actor (TA) using PowerShell without leaving readable script text on the command line.

Imagine an environment in which an operator wants to run PowerShell without leaving readable script text on the command line. 

They base64-encode the payload and pass it via `-EncodedCommand` (or its short forms `-enc`, `-e`). 

This is a long-standing living-off-the-land pattern that still appears through 2025-2026 in initial-access and lateral-movement chains.

- [https://attack.mitre.org/techniques/T1059/001/](https://attack.mitre.org/techniques/T1059/001/)
- [https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe)

// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) in ("powershell.exe", "pwsh.exe")
| filter lowercase(action_process_image_command_line) contains "-encodedcommand"
    or lowercase(action_process_image_command_line) contains " -enc "
    or lowercase(action_process_image_command_line) contains " -e "
| fields _time, agent_hostname, actor_effective_username,
    causality_actor_process_image_name, action_process_image_command_line
| limit 200