Decoding a PowerShell -EncodedCommand During Incident Response (the UTF-16 gotcha)

You're triaging an alert. Scheduled task, weird parent process, and a command line that looks like this: powershell.exe -nop -w hidden -enc JABjACAAPQAg... You know the drill: grab the Base64 blob, decode it, read the script. So you paste it into a decoder and get back this: $ c = " h t t p : / / ... Garbage. A space (or a null) between every single character. First instinct is that the payload is doubly-encoded or encrypted. It isn't. This is the single most common gotcha with -EncodedCommand , and once you know it, it takes ten seconds to fix. Why it looks garbled powershell.exe -enc (short for -EncodedCommand ) expects Base64 of UTF-16LE (little-endian Unicode) bytes — not UTF-8. That's mandated by PowerShell itself, not a choice the attacker made. In UTF-16LE, every ASCII character is stored as two bytes : the character followed by a 0x00 null byte. So the letter c isn't 0x63 , it's 0x63 0x00 . When you Base64-decode the blob and then read it as UTF-8, every one of those null bytes renders as a space or an invisible control character. Hence the h t t p spacing. Text: c = " UTF-16LE: 63 00 3D 00 22 00 UTF-8 view: c ␀ = ␀ " ␀ <- the null shows up as a "space" Decode it as UTF-16LE instead and the nulls disappear, because that's what they were: the high byte of each 16-bit code unit. Decode it correctly In PowerShell itself — the encoding is literally called Unicode in .NET, which means UTF-16LE: $enc = 'JABjACAAPQAg...' [ System.Text.Encoding ]:: Unicode.GetString ([ System.Convert ]:: FromBase64String ( $enc )) In Python — decode the bytes, then read them as utf-16-le : import base64 enc = " JABjACAAPQAg... " print ( base64 . b64decode ( enc ). decode ( " utf-16-le " )) In CyberChef — build the recipe From Base64 → Decode text (UTF-16LE) . Or From Base64 then Remove null bytes for a quick-and-dirty look. Any of these turns the spaced-out mess back into readable PowerShell. The encode direction (for building test cases) If you're writing detections or a lab sample