What it can do
- Extract the encoded argument from a complete command line
- Decode Base64 and Windows UTF-16LE
- Format the recovered script for review
How the recipe works
Regular expression
Select the long Base64 token from the surrounding command line.
From Base64
Recover the encoded byte stream.
Decode text
Interpret two-byte little-endian code units as text.
Generic Code Beautify
Add line breaks and indentation without executing the script.
Demonstration
Sample input
powershell.exe -NoProfile -EncodedCommand VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEgAZQBsAGwAbwAgAGYAcgBvAG0AIABTAGUAcgBpAGEAbABpAHoAZQAiADsAIAAkAHMAdABhAHQAdQBzACAAPQAgACIAZABlAGMAbwBkAGUAZAAiADsAExpected result
Write-Output "Hello from Serialize"When to use it
- Alert triage
- Command-line review
- Safe static script inspection
Adapt it
Append Extract URLs, Strings, or a hash operation for a report-ready static-analysis workflow; do not execute recovered code.
Source and verification
Adapted from kraven-security CyberChef recipes. The explanation and sample are written for Serialize, use synthetic or documentation-safe data, and are checked against the current operation catalogue. The workflow runs locally without an external API call.