Decoding a PowerShell -EncodedCommand During Incident Response (the UTF-16 gotcha)

You're triaging an alert. Scheduled task, weird parent process, and a command line that looks like this:

powershell.exe -nop -w hidden -enc JABjACAAPQAg...

Enter fullscreen mode

Exit fullscreen mode

You know the drill: grab the Base64 blob, decode it, read the script. So you paste it into a decoder and get back this: