PowerShell EncodedCommand Decoder

Paste a -EncodedCommand blob or the whole powershell.exe command line. It decodes UTF-16LE, follows nested base64 layers, flags the behaviours worth triaging first, and pulls out defanged URLs and IPs you can paste straight into a ticket.

Everything on this page happens in your browser. Nothing you paste is uploaded, logged, or stored — you can pull the network cable and it still works.

Encoded command or full command line

Ctrl + Enter runs it too

Where you meet this

Event ID 4688 (process creation) and Sysmon event ID 1 record the full command line, so an encoded payload shows up there verbatim. PowerShell script block logging (event ID 4104) will often have already decoded it for you — but 4688 is the one that is usually on by default, and it is what lands in a Defender for Endpoint timeline.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} |
    Where-Object { $_.Message -match '-[eE][nN][cC]' } |
    Select-Object TimeCreated, @{n='Cmd';e={$_.Properties[8].Value}}

Why UTF-16

-EncodedCommand expects base64 of a UTF-16LE string, which is why a plain base64 -d gives you text with a null byte between every character. This page detects the encoding either way, and follows up to three nested base64 layers — a common way to hide the real payload from a naive grep.

This is pattern matching, not analysis. It will not catch novel obfuscation, and a clean result means nothing more than "none of the usual patterns matched". Detonate anything you are unsure about in a sandbox, preserve the original sample, and follow your incident process.