What -EncodedCommand was hiding
A process-creation event shows PowerShell started with -enc and a long base64 string. Decode it, deal with the UTF-16 bytes, and find the URL it downloads.
Briefing
Sysmon on a finance laptop logged a PowerShell process started by a shortcut file that arrived by email. The command line carries -EncodedCommand.
PowerShell’s -EncodedCommand is base64 of UTF-16LE text, so every other byte after decoding is a zero. The export of the event is in ~/case/event-4688.txt and the encoded string alone is in ~/case/encoded.txt.
ir-workstation · Decoding artifacts
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.