Skip to content

Decode a PowerShell EncodedCommand

Extract, decode, interpret, and format a PowerShell EncodedCommand without executing it.

Install in Serialize

What it can do

  • Extract the encoded argument from a complete command line
  • Decode Base64 and Windows UTF-16LE
  • Format the recovered script for review

How the recipe works

Regular expression

Select the long Base64 token from the surrounding command line.

From Base64

Recover the encoded byte stream.

Decode text

Interpret two-byte little-endian code units as text.

Generic Code Beautify

Add line breaks and indentation without executing the script.

Demonstration

Sample input

powershell.exe -NoProfile -EncodedCommand VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEgAZQBsAGwAbwAgAGYAcgBvAG0AIABTAGUAcgBpAGEAbABpAHoAZQAiADsAIAAkAHMAdABhAHQAdQBzACAAPQAgACIAZABlAGMAbwBkAGUAZAAiADsA

Expected result

Write-Output "Hello from Serialize"

When to use it

  • Alert triage
  • Command-line review
  • Safe static script inspection

Adapt it

Append Extract URLs, Strings, or a hash operation for a report-ready static-analysis workflow; do not execute recovered code.

Source and verification

Adapted from kraven-security CyberChef recipes. The explanation and sample are written for Serialize, use synthetic or documentation-safe data, and are checked against the current operation catalogue. The workflow runs locally without an external API call.

Navigation

Type to search…

↑↓ navigate↵ selectEsc close