PowerShell decoder

Q: What is a PowerShell encoded command?

PowerShell's -EncodedCommand option (often shortened to -enc or -e) takes a script encoded as Base64 of UTF-16LE text. It exists for passing complex commands safely, but attackers use it to hide what a command does from people and simple detection rules.

Q: Which obfuscation does it undo?

EncodedCommand and bare Base64, nested FromBase64String, Deflate and GZip compressed loaders, string concatenation, backtick escapes, [char] codes and the -f format operator, repeated until nothing changes.

Q: Is my sample uploaded?

No. Decoding runs entirely in your browser. Nothing is uploaded, stored or logged.

Decode PowerShell -EncodedCommand, Base64, Deflate and GZip loaders and common obfuscation into readable script, with suspicious commands and indicators picked out. Nothing is executed.

Runs in your browser. Nothing you paste is uploaded, stored or logged.

Command line, encoded blob or script

How it works

Malicious PowerShell turns up in a large share of endpoint alerts, and it is almost always hidden: an encoded command line, a compressed payload inside it, and strings split up so that keywords like Invoke-Expression never appear whole.

Paste the full command line from the alert, just the encoded blob, or a script. The decoder finds the encoded command, decodes it, then keeps unpacking nested Base64 and compressed content and rejoining split strings until the script is readable. It lists each layer it removed, points out suspicious behaviour such as downloads, hidden windows, execution-policy bypass and Defender tampering, and pulls out the URLs, domains and IP addresses inside, defanged and ready to check.

Questions

What is a PowerShell encoded command?

PowerShell’s -EncodedCommand option, often shortened to -enc, -e or -ec, takes a script encoded as Base64 of UTF-16LE text. It exists so complex commands can be passed without quoting problems, but attackers use it to hide what a command does from people reading alerts and from simple detection rules.

Does this tool run the script?

No. Every step is a text transformation: Base64 decoding, character decoding, decompression and joining split-up strings. Nothing is executed or evaluated, and the result is shown in a read-only box. Do not run decoded scripts yourself; use a sandbox if you need to see their behaviour.

Which obfuscation does it undo?

-EncodedCommand and bare Base64 (UTF-16LE or UTF-8), nested FromBase64String, Deflate and GZip compressed loaders, string concatenation like 'Inv'+'oke', backtick tricks like I`nv`oke, [char] codes and the -f format operator. Layers are undone repeatedly until nothing more changes. Heavily customised obfuscators may still need a sandbox.

Is my sample uploaded?

No. Decoding runs entirely in your browser, and nothing is uploaded, stored or logged. That matters when a command line contains internal host names, user names or tokens.